Solved: Feed configuration -Yara Rule - Page 2

Rached1996

Hello community , i want to ask if there is any possibility to develop a yara rule that detect if any change have been made on FEEDs , for example if a user changes a feed secret key.
Thanks for help

cmorris

You would focus principal.user.attribute.permissions.name on the below values.

So for a basic rule just focused on updating feeds, you might start with something like this and then update it to include additional info via an outcome section:

rule secops_feed_updated {
  meta:
    author = "gcs"
    description = "Detect updates to SecOps feeds"
    severity = "Low"

  events:
    $e.metadata.log_type = "GCP_CLOUDAUDIT"
    $e.metadata.product_name = "Google Cloud Platform"
    $e.principal.user.attribute.permissions.name = "chronicle.feeds.update"

  condition:
    $e
}

View solution in original post

New SecOps Webinar May 14th! Learn about Gemini's generative AI within Google SecOps

Feed configuration -Yara Rule