Threats - Persistence: New Geography

Explanation:

GCP SCC detect new geographical location which try to access the target GCP resource.

For this example:

xx@xxx.com is usually accessing from "US". It is detected that this principal email is now accessing from FR.

Resolution:

Verify if the reported principal email is indeed coming for the reported location.

If is not, it could mean that hacker is trying to access to this resource. 

Pattern:

{
	"anomalousLocation": {
		"anomalousLocation": "FR",
		"callerIp": "xx.xx.xx.xx",
		"principalEmail": "xx@xxx.com",
		"notSeenInLast": "2592000s",
		"typicalGeolocations": [{
				"country": {
					"identifier": "US"
				}
			}
		]
	}
}