Detection: DNS Managed Zone Updated
Overview
Detect when a DNS managed zone was updated. Unauthorized changes can disrupt domain configurations, compromise infrastructure, or introduce vulnerabilities. Monitoring these actions helps ensure DNS configurations remain secure.
References:
Usage
Run the detection in your terminal:
powerpipe detection run gcp_audit_log_detections.detection.dns_managed_zone_updatedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run gcp_audit_log_detections.detection.dns_managed_zone_updated --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,method_name as operation,resource_name as resource,authentication_info.principal_email as actor,tp_source_ip as source_ip,tp_index as project,tp_id as source_id,-- Create new aliases to preserve original row data*
from gcp_audit_logwhere method_name ilike 'dns.managedzones.patch' and severity != 'Error'-- TODO: Do we need to check operation?-- and (operation_src is null or operation_src.last = true)
order by timestamp desc;