GCP Audit Logs - VPC Flow Logs Disabled | Microsoft Sentinel Analytic Rules

Back


Id	8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a
Rulename	GCP Audit Logs - VPC Flow Logs Disabled
Description	Detects when Google Cloud Platform VPC Flow Logs configurations are disabled or deleted. VPC Flow Logs capture information about IP traffic going to and from network interfaces in VPC networks, providing critical visibility for security monitoring and forensic analysis. Disabling VPC Flow Logs reduces network visibility and may indicate an attempt to evade detection before performing malicious activities. Adversaries may disable flow logs to hide lateral movement, data exfiltration, or command and control traffic.
Severity	High
Tactics	DefenseEvasion
Techniques	T1562.001
Required data connectors	GCPAuditLogsDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPVpcFlowLogsDisabled.yaml
Version	1.0.0
Arm template	8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a.json

KQL

GCPAuditLogs
| where ServiceName == "networkmanagement.googleapis.com"
| where MethodName has_any ("VpcFlowLogsService.UpdateVpcFlowLogsConfig", "VpcFlowLogsService.DeleteVpcFlowLogsConfig")
| extend 
    RequestJson = parse_json(Request),
    RequestMetadataJson = parse_json(RequestMetadata),
    AuthInfoJson = parse_json(AuthenticationInfo),
    AuthzInfoJson = parse_json(AuthorizationInfo)
| extend 
    FlowLogsConfigName = split(GCPResourceName, "/")[-1],
    ConfigState = tostring(RequestJson.vpc_flow_logs_config.state),
    CallerIpAddress = tostring(RequestMetadataJson.callerIp),
    AuthEmail = tostring(AuthInfoJson.principalEmail),
    Permission = tostring(AuthzInfoJson[0].permission),
    PermissionType = tostring(AuthzInfoJson[0].permissionType),
    PermissionGranted = tostring(AuthzInfoJson[0].granted)
| where PermissionType == "ADMIN_WRITE"
| where MethodName has "DeleteVpcFlowLogsConfig" or ConfigState == "DISABLED"
| extend 
    Action = case(
        MethodName has "DeleteVpcFlowLogsConfig", "Deleted",
        ConfigState == "DISABLED", "Disabled",
        "Modified"),
    AccountName = tostring(split(PrincipalEmail, "@")[0]), 
    AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
| project TimeGenerated,
          PrincipalEmail,
          AuthEmail,
          ProjectId,
          ResourceName = GCPResourceName,
          FlowLogsConfigName,
          Action,
          CallerIpAddress,
          MethodName,
          ServiceName,
          Severity,
          Permission,
          PermissionGranted,
          LogName,
          InsertId,
          AccountName,
          AccountUPNSuffix

YAML

tags:
- GCP
- VPC Flow Logs
- Network Security
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPVpcFlowLogsDisabled.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - GCPAuditLogs
  connectorId: GCPAuditLogsDefinition
tactics:
- DefenseEvasion
relevantTechniques:
- T1562.001
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |-
    GCP VPC Flow Logs configuration {{FlowLogsConfigName}} {{Action}} in project {{ProjectId}}.
    This action reduces network traffic visibility and may indicate an attempt to evade detection.    
    Investigate immediately to determine if this action was authorized and assess the security implications.
    Review recent network activity before the logs were disabled for signs of malicious behavior.
  alertDisplayNameFormat: GCP VPC Flow Logs {{FlowLogsConfigName}} {{Action}} by {{PrincipalEmail}}
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: PrincipalEmail
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: CallerIpAddress
  entityType: IP
- fieldMappings:
  - identifier: Name
    columnName: ProjectId
  - identifier: InstanceName
    columnName: ResourceName
  entityType: CloudApplication
description: |
  'Detects when Google Cloud Platform VPC Flow Logs configurations are disabled or deleted.
  VPC Flow Logs capture information about IP traffic going to and from network interfaces in VPC networks, providing critical visibility for security monitoring and forensic analysis.
  Disabling VPC Flow Logs reduces network visibility and may indicate an attempt to evade detection before performing malicious activities.
  Adversaries may disable flow logs to hide lateral movement, data exfiltration, or command and control traffic.'
triggerOperator: gt
status: Available
queryFrequency: 1h
id: 8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a
name: GCP Audit Logs - VPC Flow Logs Disabled
severity: High
query: |
  GCPAuditLogs
  | where ServiceName == "networkmanagement.googleapis.com"
  | where MethodName has_any ("VpcFlowLogsService.UpdateVpcFlowLogsConfig", "VpcFlowLogsService.DeleteVpcFlowLogsConfig")
  | extend 
      RequestJson = parse_json(Request),
      RequestMetadataJson = parse_json(RequestMetadata),
      AuthInfoJson = parse_json(AuthenticationInfo),
      AuthzInfoJson = parse_json(AuthorizationInfo)
  | extend 
      FlowLogsConfigName = split(GCPResourceName, "/")[-1],
      ConfigState = tostring(RequestJson.vpc_flow_logs_config.state),
      CallerIpAddress = tostring(RequestMetadataJson.callerIp),
      AuthEmail = tostring(AuthInfoJson.principalEmail),
      Permission = tostring(AuthzInfoJson[0].permission),
      PermissionType = tostring(AuthzInfoJson[0].permissionType),
      PermissionGranted = tostring(AuthzInfoJson[0].granted)
  | where PermissionType == "ADMIN_WRITE"
  | where MethodName has "DeleteVpcFlowLogsConfig" or ConfigState == "DISABLED"
  | extend 
      Action = case(
          MethodName has "DeleteVpcFlowLogsConfig", "Deleted",
          ConfigState == "DISABLED", "Disabled",
          "Modified"),
      AccountName = tostring(split(PrincipalEmail, "@")[0]), 
      AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
  | project TimeGenerated,
            PrincipalEmail,
            AuthEmail,
            ProjectId,
            ResourceName = GCPResourceName,
            FlowLogsConfigName,
            Action,
            CallerIpAddress,
            MethodName,
            ServiceName,
            Severity,
            Permission,
            PermissionGranted,
            LogName,
            InsertId,
            AccountName,
            AccountUPNSuffix
queryPeriod: 1h
customDetails:
  ResourceName: ResourceName
  Permission: Permission
  ProjectId: ProjectId
  FlowLogsConfigName: FlowLogsConfigName
  Action: Action

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "GCP VPC Flow Logs configuration {{FlowLogsConfigName}} {{Action}} in project {{ProjectId}}.\nThis action reduces network traffic visibility and may indicate an attempt to evade detection.    \nInvestigate immediately to determine if this action was authorized and assess the security implications.\nReview recent network activity before the logs were disabled for signs of malicious behavior.",
          "alertDisplayNameFormat": "GCP VPC Flow Logs {{FlowLogsConfigName}} {{Action}} by {{PrincipalEmail}}"
        },
        "alertRuleTemplateName": "8f3e9c2d-5b4a-4d6e-9a7c-2f8b5e1d3c9a",
        "customDetails": {
          "Action": "Action",
          "FlowLogsConfigName": "FlowLogsConfigName",
          "Permission": "Permission",
          "ProjectId": "ProjectId",
          "ResourceName": "ResourceName"
        },
        "description": "'Detects when Google Cloud Platform VPC Flow Logs configurations are disabled or deleted.\nVPC Flow Logs capture information about IP traffic going to and from network interfaces in VPC networks, providing critical visibility for security monitoring and forensic analysis.\nDisabling VPC Flow Logs reduces network visibility and may indicate an attempt to evade detection before performing malicious activities.\nAdversaries may disable flow logs to hide lateral movement, data exfiltration, or command and control traffic.'\n",
        "displayName": "GCP Audit Logs - VPC Flow Logs Disabled",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "PrincipalEmail",
                "identifier": "FullName"
              },
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "CallerIpAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectId",
                "identifier": "Name"
              },
              {
                "columnName": "ResourceName",
                "identifier": "InstanceName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPVpcFlowLogsDisabled.yaml",
        "query": "GCPAuditLogs\n| where ServiceName == \"networkmanagement.googleapis.com\"\n| where MethodName has_any (\"VpcFlowLogsService.UpdateVpcFlowLogsConfig\", \"VpcFlowLogsService.DeleteVpcFlowLogsConfig\")\n| extend \n    RequestJson = parse_json(Request),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    AuthInfoJson = parse_json(AuthenticationInfo),\n    AuthzInfoJson = parse_json(AuthorizationInfo)\n| extend \n    FlowLogsConfigName = split(GCPResourceName, \"/\")[-1],\n    ConfigState = tostring(RequestJson.vpc_flow_logs_config.state),\n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    AuthEmail = tostring(AuthInfoJson.principalEmail),\n    Permission = tostring(AuthzInfoJson[0].permission),\n    PermissionType = tostring(AuthzInfoJson[0].permissionType),\n    PermissionGranted = tostring(AuthzInfoJson[0].granted)\n| where PermissionType == \"ADMIN_WRITE\"\n| where MethodName has \"DeleteVpcFlowLogsConfig\" or ConfigState == \"DISABLED\"\n| extend \n    Action = case(\n        MethodName has \"DeleteVpcFlowLogsConfig\", \"Deleted\",\n        ConfigState == \"DISABLED\", \"Disabled\",\n        \"Modified\"),\n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project TimeGenerated,\n          PrincipalEmail,\n          AuthEmail,\n          ProjectId,\n          ResourceName = GCPResourceName,\n          FlowLogsConfigName,\n          Action,\n          CallerIpAddress,\n          MethodName,\n          ServiceName,\n          Severity,\n          Permission,\n          PermissionGranted,\n          LogName,\n          InsertId,\n          AccountName,\n          AccountUPNSuffix\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "tags": [
          "GCP",
          "VPC Flow Logs",
          "Network Security"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}