GCP-NET - Cloud NAT or Cloud Router Modification
This rule detects modifications to Google Cloud Platform (GCP) Cloud Routers by monitoring audit logs for non-read operations. It flags changes made by human users, service accounts not utilizing Terraform, or service accounts originating from unexpected network sources as high-priority, while tracking general router creations and deletions.
Sigma
