GCP-NET - Firewall Rule Deletion

Christopher Scott@Scocha

•updated Aug 8, 2026•1•0•6

This rule detects the deletion of Google Cloud Platform (GCP) network firewall rules. It monitors GCP audit logs for 'v1.compute.firewalls.delete' or 'beta.compute.firewalls.delete' actions. The rule categorizes the actor (human vs. service account) and identifies if the deletion originated from Terraform, providing context on whether the action was likely an automated infrastructure-as-code change or manual intervention.