August 18, 2026
What Are Data Tables?
Data tables are structured lookup tables managed in Google SecOps with named columns and rows. They support multiple columns, making them ideal for enrichment and allow/block patterns.
Syntax in YARA-L
Data tables use $table_name[column_name] syntax:
$event.principal.user.email_addresses in $approved_accounts[email]
not $event.principal.ip in $known_scanners[ip_address]
Allow-list: Use not ... in $table[column] to exclude known-good values. When a new service account is approved, add a row to the table instead of editing the rule.
Block-list: Use ... in $table[column] to match known-bad IOCs. Update the table with fresh indicators from threat intel feeds.
Enrichment: Tables with multiple columns add context. A table $asset_criticality with hostname and tier columns lets you prioritize by asset value.
Working Rule: Unapproved Secret Access
rule detect_unapproved_secret_access {
meta:
author = "SecOps Team"
description = "Service account accessing secrets not in approved list"
severity = "CRITICAL"
mitre_attack = "T1555"
events:
$secret.metadata.log_type = "GCP_CLOUDAUDIT"
$secret.metadata.product_event_type = "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"
$secret.principal.user.email_addresses = $sa_email
$secret.target.resource.name = $resource
not $sa_email in $approved_service_accounts[email]
not $resource in $approved_secrets[secret_name]
match:
$sa_email over 10m
outcome:
$secret_count = count_distinct($resource)
$secrets_accessed = array_distinct($resource)
condition:
$secret and $secret_count >= 1
}
How the Data Tables Work Here
$approved_service_accounts has an email column listing authorized accounts. $approved_secrets has a secret_name column listing expected secrets. When your environment changes, update the table, not the rule. Manage tables in Settings > Data Tables via CSV upload, manual entry, or API.
(This rule will only compile if the proper data tables are in place)
