Detection: Artifact Registry Package Deleted
Overview
Detect when an Artifact Registry package was deleted. Package deletions could disrupt dependent workflows or indicate malicious activities. Monitoring these events ensures that package removal is authorized and does not affect production systems.
References:
Usage
Run the detection in your terminal:
powerpipe detection run gcp_audit_log_detections.detection.artifact_registry_package_deletedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run gcp_audit_log_detections.detection.artifact_registry_package_deleted --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,method_name as operation,resource_name as resource,authentication_info.principal_email as actor,tp_source_ip as source_ip,tp_index as project,tp_id as source_id,-- Create new aliases to preserve original row dataoperation as operation_src,resource as resource_src,*exclude operation, resource
from gcp_audit_logwhere method_name ilike 'google.devtools.artifact_registry.v%.artifact_registry.deletepackage' and severity != 'Error'
order by timestamp desc;