GCP Audit Logs - List All GCP VPN Tunnels Deleted

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Lists all Google Cloud VPN tunnel deletion operations to identify network connectivity changes and potential security impacts.

Attribute Value
Type Hunting Query
Solution Google Cloud Platform Audit Logs
ID 8f3e4a2b-6c7d-4e8f-9a0b-1c2d3e4f5a6b
Tactics Impact, DefenseEvasion
Techniques T1489, T1562.001
Required Connectors GCPAuditLogsDefinition
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
GCPAuditLogs GCPResourceType == "vpn_tunnel"
MethodName has "compute.vpnTunnels.delete"
ServiceName == "compute.googleapis.com"
Severity == "NOTICE"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries · Back to Google Cloud Platform Audit Logs