GCP Security Monitoring app for Splunk analyses GCP platform logs and alerts on specific security related rulesets. GCP Platform logs can be forwarded to Splunk through either: - Splunk Add-on for Google Cloud Platform - Pub/Sub to Splunk Dataflow job - Pub/Sub to Splunk Custom forwarders - https://github.com/manasmbellani/pygcplogs/tree/master/splunk Once platform logs have been forwarded, this application adds custom rules for security monitoring and alerting on these platform logs such as detection of public GCS buckets, service accounts created with excessive permissions. For list of available detections, please see the `Details` tab