{
  "Name": "GoogleCloudPlatformIAM",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/google_logo.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The Google Cloud Platform Identity and Access Management (IAM) solution provides the capability to ingest [GCP IAM logs](https://cloud.google.com/iam/docs/audit-logging) into Microsoft Sentinel using the GCP Logging API. Refer to [GCP Logging API documentation](https://cloud.google.com/logging/docs/api) for more information.\n  \n  **Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)\n\n",
  "Data Connectors": [
    "Data Connectors/GCPIAMLog_CCP/GCPIAMLog_ConnectorDefinition.json"
  ],
  "Parsers": [
    "Parsers/GCP_IAM.yaml"
  ],
  "Workbooks": [
    "Workbooks/GCP_IAM.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/GCPIAMDisableDataAccessLogging.yaml",
    "Analytic Rules/GCPIAMEmptyUA.yaml",
    "Analytic Rules/GCPIAMHighPrivilegedRoleAdded.yaml",
    "Analytic Rules/GCPIAMNewAuthenticationToken.yaml",
    "Analytic Rules/GCPIAMNewServiceAccount.yaml",
    "Analytic Rules/GCPIAMNewServiceAccountKey.yaml",
    "Analytic Rules/GCPIAMPrivilegesEnumeration.yaml",
    "Analytic Rules/GCPIAMPublicBucket.yaml",
    "Analytic Rules/GCPIAMServiceAccountEnumeration.yaml",
    "Analytic Rules/GCPIAMServiceAccountKeysEnumeration.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/GCPIAMChangedRoles.yaml",
    "Hunting Queries/GCPIAMDeletedServiceAccounts.yaml",
    "Hunting Queries/GCPIAMDisabledServiceAccounts.yaml",
    "Hunting Queries/GCPIAMNewCustomRoles.yaml",
    "Hunting Queries/GCPIAMNewServiceAccounts.yaml",
    "Hunting Queries/GCPIAMNewServiceAccountsKeys.yaml",
    "Hunting Queries/GCPIAMRareActionUser.yaml",
    "Hunting Queries/GCPIAMRareUA.yaml",
    "Hunting Queries/GCPIAMTopServiceAccountsFailedActions.yaml",
    "Hunting Queries/GCPIAMTopSrcIpAddrFailedActions.yaml"
  ],
  "Playbooks": [
    "Playbooks/GCP_IAMConnector/azuredeploy.json",
    "Playbooks/GCP-DisableServiceAccountFromTeams/azuredeploy.json",
    "Playbooks/GCP-DisableServiceAccountKey/azuredeploy.json",
    "Playbooks/GCP-EnrichServiseAccountInfo/azuredeploy.json"
  ],
  "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\GoogleCloudPlatformIAM",
  "Version": "3.0.5",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1Pconnector": false
}