gcp-scc-explicit-notificationconfig-delete
Principal holds effective securitycenter.notificationconfigs.delete permission to delete notification routing configs.
match (effective permission)
{
"action": "securitycenter.notificationconfigs.delete",
"resource_type": [
"google.securitycenter.OrganizationSettings",
"google.securitycenter.ProjectSettings"
]
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?scc |
| permissions | securitycenter.notificationconfigs.delete |
| conditions | iam_permission |
Narrative
{principal.name} holds securitycenter.notificationconfigs.delete permission at {scc.scope}, enabling deletion of notification configs that route SCC findings to external systems (SIEM, SOAR, ticketing).
Raw rule rules/explicit/gcp-scc.yaml
id: gcp-scc-explicit-notificationconfig-delete
emits: HasPermission
description: Principal holds effective securitycenter.notificationconfigs.delete permission to delete
notification routing configs.
match_effective_permission:
action: securitycenter.notificationconfigs.delete
resource_type:
- google.securitycenter.OrganizationSettings
- google.securitycenter.ProjectSettings
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?scc
permissions:
- securitycenter.notificationconfigs.delete
conditions:
- iam_permission
confidence: 0.85
narrative: '{principal.name} holds securitycenter.notificationconfigs.delete permission at {scc.scope},
enabling deletion of notification configs that route SCC findings to external systems (SIEM, SOAR,
ticketing).'