GCP Security Command Center Service Disabled
This rule detects when Security Command Center services are disabled in Google Cloud Platform (GCP). Disabling Security Command Center can impair an organization's ability to detect security threats and vulnerabilities, making it a critical security event. The rule specifically looks for 'RESOURCE_WRITTEN' events in GCP Cloud Audit logs where the product event type indicates an update to Security Command Center settings, the target application is 'securitycenter.googleapis.com', and the 'service_enablement_state' label is set to 'DISABLED'.
YARA-L
