GCP Cloud Function Triggered for Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP POST requests to 'cloudfunctions.net', indicating a Google Cloud Function is being triggered for execution. The rule uses a threshold to alert only if 20 such requests are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent triggers.