Set up the gcp integration.
Detect when there is unauthorized activity by a service account in GCP
Monitor GCP logs and detect when a service account makes an API request and the request returns the status code equal to
7 within the log attribute
@data.protoPayload.status.code. The status code
7 indicates the service account did not have permission to make the API call.