Hi, is there a way to check the user that has last updated a rule from the SecOps platform without checking cloud looging?
Question
Check user that last updated the rule
+10- Bronze 4
Hi,
You can query Audit Events Directly in SecOps UDM Search:
metadata.vendor_name = "Google Cloud Platform"
metadata.product_event_type = /RuleService\.(UpdateRule|CreateRule|UpdateRuleDeployment)|MalachiteFrontendService\.WriteRule/
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.