Google Cloud Identity Low to Medium Severity Alert Escalation
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
YARA-L
