Cleanup rba

splunk · Nov 15, 2024 · 1af44a3 · 1af44a3
1 parent 2f98865
commit 1af44a3
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
@@ -41,8 +41,11 @@ known_false_positives: GCP Storage buckets can be accessed from any IP (if the A
   hours.
 references: []
 rba:
-  message: tbd
-  risk_objects: []
+  message: GCP Bucket $bucket_name$ accessed from a new IP ($remote_ip$)
+  risk_objects: 
+  - field: bucket_name
+    type: system
+    score: 25
   threat_objects:
   - field: remote_ip
     type: ip_address