Detection: Apigee Security Action Disabled
Overview
DeDetect when a security action in Apigee was disabled. Security actions are used to enforce security policies and protect APIs from threats. Monitoring these changes helps ensure that security measures are consistently applied and that APIs remain secure.
References:
Usage
Run the detection in your terminal:
powerpipe detection run gcp_audit_log_detections.detection.apigee_security_action_disabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run gcp_audit_log_detections.detection.apigee_security_action_disabled --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,method_name as operation,resource_name as resource,authentication_info.principal_email as actor,tp_source_ip as source_ip,tp_index as project,tp_id as source_id,-- Create new aliases to preserve original row data*
from gcp_audit_logwhere (method_name ilike 'google.cloud.apigee.v%.securityactionservice.disablesecurityaction') and severity != 'Error'-- TODO: Do we need to check operation?-- and (operation_src is null or operation_src.last = true)
order by timestamp desc;