5.31 - Cloud Storage objects accessed from a new IP

Cloud Storage objects accessed from a new IP address, first-time seen in the last 24 hours. List Cloud Storage resource's name, user action and calling user identity if available. Default lookback window is 60 days.

Category: Data Usage
Use Cases: Audit, Detect
Data Sources: Audit Logs - Data Access

Queries or Rules

BigQuery	Log Analytics	Google SecOps
SQL	SQL	Contribute rule

Event Generation

No event generation steps provided. Contribute emulation test to this use case.

Sample Event

No log samples provided. Contribute log samples to this use case.