GCP-NET - Cloud VPN Tunnel Creation or Deletion
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
Sigma
