Hello,
I want to use chronicle SIEM to monitor cloud storage, so I can be alert in things like:
- High volume of data downloads, e.g. over a certain threshold of data.
- High number of files.
- Downloads from unusual IP addresses or IP addresses other than a few known ones.
- New identity/account downloading data.
I checked the docs and the Cloud Audit Logs parser supports sources does not include Cloud Storage data access and field mapping references I can't find storage.objects.get. Does it mean that by default this logs are not supported.
Can you provide some ideas about what will be required to start monitoring cloud storage data access logs with Chronicle SIEM?