Pubsub

This rule detects the creation of a subscription in Google Cloud Platform (GCP) Pub/Sub, which could indicate unauthorized access to data streams by adversaries attempting to intercept or exfiltrate sensitive information.

Detection of Google Cloud Platform Pub/Sub topic deletions can indicate an attempt to disrupt message flow and potentially evade defenses by impairing logging or event-driven automation.

Detection of a Google Cloud Platform Pub/Sub subscription deletion, which can be used by adversaries to disrupt communication, evade detection, or impair defenses.