Remove unused ResourceName mapping in GCP VM snapshot rule

Author: rahul0216

Solutions/Google Cloud Platform Audit Logs/Analytic Rules/GCPBulkVMSnapshotDeletion.yaml

@@ -66,7 +66,6 @@ query: |
       TimeGenerated = FirstDeletion,
       PrincipalEmail,
       ProjectId,
-      ResourceName = GCPResourceName,
       SnapshotCount,
       SnapshotList,
       FirstDeletion,
@@ -76,7 +75,7 @@ query: |
       UserAgent,
       OperationIds,
       AccountName,
-      AccountUPNSuffix,
+      AccountUPNSuffix
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -90,8 +89,6 @@ entityMappings:
     fieldMappings:
       - identifier: Name
         columnName: ProjectId
-      - identifier: InstanceName
-        columnName: ResourceName
 customDetails:
   ProjectId: ProjectId
   SnapshotCount: SnapshotCount

Solutions/Google Cloud Platform Audit Logs/Package/3.0.2.zip

@@ -618,7 +618,7 @@
                 "description": "Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities.\nVM snapshots are critical for backup and disaster recovery. Bulk deletion of snapshots can prevent recovery from incidents and may indicate\nmalicious activity such as ransomware, data destruction, or an attempt to cover tracks after a security breach.\nAdversaries may delete snapshots to maximize damage, prevent forensic investigation, or hinder recovery efforts.\nThis rule triggers when multiple snapshots are deleted by the same user within a 1-minute window.",
                 "displayName": "GCP Audit Logs - Detect Bulk VM Snapshot Deletion",
                 "enabled": false,
-                "query": "// Update these thresholds if noisy in your environment\nlet SnapshotDeletionThreshold = 10;\nlet TimeWindow = 1m;\nGCPAuditLogs\n| where ServiceName == \"compute.googleapis.com\"\n| where MethodName has \"compute.snapshots.delete\"\n| where GCPResourceType == \"gce_snapshot\" and Severity == \"NOTICE\"\n| extend \n    AuthzInfoJson = parse_json(AuthorizationInfo),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    ResponseJson = parse_json(Response)\n| extend PermissionType = tostring(AuthzInfoJson[0].permissionType)\n| where PermissionType == \"ADMIN_WRITE\"\n| extend \n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),\n    SnapshotName = extract(@\"snapshots/([^/]+)\", 1, GCPResourceName),\n    OperationType = tostring(ResponseJson.operationType),\n    OperationId = tostring(ResponseJson.id)\n| summarize \n    SnapshotCount = count(),\n    SnapshotList = make_set(SnapshotName, 100),\n    FirstDeletion = min(TimeGenerated),\n    LastDeletion = max(TimeGenerated),\n    OperationIds = make_set(OperationId, 100),\n    CallerIPs = make_set(CallerIpAddress, 10)\n    by PrincipalEmail, ProjectId, UserAgent\n| where SnapshotCount >= SnapshotDeletionThreshold\n| extend DeletionTimeSpan = LastDeletion - FirstDeletion\n| where DeletionTimeSpan <= TimeWindow\n| extend \n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project \n    TimeGenerated = FirstDeletion,\n    PrincipalEmail,\n    ProjectId,\n    ResourceName = GCPResourceName,\n    SnapshotCount,\n    SnapshotList,\n    FirstDeletion,\n    LastDeletion,\n    DeletionTimeSpan,\n    CallerIPs,\n    UserAgent,\n    OperationIds,\n    AccountName,\n    AccountUPNSuffix,\n",
+                "query": "// Update these thresholds if noisy in your environment\nlet SnapshotDeletionThreshold = 10;\nlet TimeWindow = 1m;\nGCPAuditLogs\n| where ServiceName == \"compute.googleapis.com\"\n| where MethodName has \"compute.snapshots.delete\"\n| where GCPResourceType == \"gce_snapshot\" and Severity == \"NOTICE\"\n| extend \n    AuthzInfoJson = parse_json(AuthorizationInfo),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    ResponseJson = parse_json(Response)\n| extend PermissionType = tostring(AuthzInfoJson[0].permissionType)\n| where PermissionType == \"ADMIN_WRITE\"\n| extend \n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),\n    SnapshotName = extract(@\"snapshots/([^/]+)\", 1, GCPResourceName),\n    OperationType = tostring(ResponseJson.operationType),\n    OperationId = tostring(ResponseJson.id)\n| summarize \n    SnapshotCount = count(),\n    SnapshotList = make_set(SnapshotName, 100),\n    FirstDeletion = min(TimeGenerated),\n    LastDeletion = max(TimeGenerated),\n    OperationIds = make_set(OperationId, 100),\n    CallerIPs = make_set(CallerIpAddress, 10)\n    by PrincipalEmail, ProjectId, UserAgent\n| where SnapshotCount >= SnapshotDeletionThreshold\n| extend DeletionTimeSpan = LastDeletion - FirstDeletion\n| where DeletionTimeSpan <= TimeWindow\n| extend \n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project \n    TimeGenerated = FirstDeletion,\n    PrincipalEmail,\n    ProjectId,\n    SnapshotCount,\n    SnapshotList,\n    FirstDeletion,\n    LastDeletion,\n    DeletionTimeSpan,\n    CallerIPs,\n    UserAgent,\n    OperationIds,\n    AccountName,\n    AccountUPNSuffix\n",
                 "queryFrequency": "PT15M",
                 "queryPeriod": "PT15M",
                 "severity": "High",
@@ -670,10 +670,6 @@
                       {
                         "identifier": "Name",
                         "columnName": "ProjectId"
-                      },
-                      {
-                        "identifier": "InstanceName",
-                        "columnName": "ResourceName"
                       }
                     ],
                     "entityType": "CloudApplication"