GCP Secret Manager Secret Accessed via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•4

This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.