google-cloud-platform

GCP Cloud Audit Logs for anomaly detection are interpreted by analyzing Admin Activity, Data Access, System Event, and Policy Denied logs to identify anomalous activity and produce production-ready detections. This skill maps those log types to support detection engineering workflows.

Detecting IAM privilege abuse in Google Cloud Platform involves analyzing service accounts, keys, workload identity federation, and impersonation mechanics. You detect abuse by interpreting cross-project access patterns and mapping them to security telemetry for detection engineering.

GCP security telemetry is mapped to Chronicle YARA-L rules by aligning Cloud Audit Logs and VPC Flow Logs with Google SecOps mappings. This streamlines SIEM ingestion and translates raw telemetry into production-ready detections for abuse detection.

VPC Flow Logs can be used to support detection engineering workflows by applying them alongside Cloud Audit Logs to identify anomalous network activity. This skill interprets VPC Flow Logs to produce production-ready detections aligned with SIEM ingestion requirements.

Workload identity federation for GCP security telemetry analysis is needed when interpreting IAM mechanics for privilege abuse detection. Understanding impersonation and cross-project access patterns through federation is essential for mapping telemetry to effective abuse detections.