Ce document décrit un type de résultat de détection de menace dans Security Command Center. Ces résultats sont générés par les détecteurs de menaces lorsqu'ils détectent une menace potentielle dans vos ressources cloud. Pour obtenir la liste complète des résultats de détection de menace disponibles, consultez cet index.
L'exfiltration de données de Cloud SQL initiée par un agent d'IA est détectée en examinant les journaux d'audit pour les données d'instance actives exportées vers un bucket Cloud Storage appartenant à l'organisation et accessible au public.
Tous les types d'instances Cloud SQL sont compatibles.
Pour les activations au niveau du projet du niveau Security Command Center Premium, ce résultat n'est disponible que si le niveau Standard (ancienne version) est activé dans l'organisation parente.
Le plan de réponse suivant peut être adapté à ce résultat, mais il peut également avoir un impact sur vos opérations.
Veillez à bien évaluer les informations que vous collectez dans votre enquête pour déterminer quelle est la meilleure réponse à apporter aux problèmes soulevés par les résultats.
Voici un exemple du JSON du résultat, avec les valeurs par défaut omises.
{
"finding": {
"name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
"parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
"resourceName": "//cloudsql.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_NAME",
"state": "ACTIVE",
"category": "Exfiltration: AI Agent Initiated CloudSQL Exfiltration to Public Bucket",
"securityMarks": {
"name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID/securityMarks"
},
"eventTime": "TIMESTAMP",
"createTime": "TIMESTAMP",
"severity": "HIGH",
"canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
"findingClass": "THREAT",
"access": {
"callerIp": "IP_ADDRESS",
"callerIpGeo": {
"regionCode": "COUNTRY_CODE"
},
"serviceName": "cloudsql.googleapis.com",
"methodName": "cloudsql.instances.export",
"principalSubject": "principal://agents.global.org-ORGANIZATION_ID.system.id.goog/resources/aiplatform/projects/PROJECT_NUMBER/locations/LOCATION/reasoningEngines/REASONING_ENGINE_ID"
},
"mitreAttack": {
"primaryTactic": "EXFILTRATION",
"primaryTechniques": [
"EXFILTRATION_OVER_WEB_SERVICE",
"EXFILTRATION_TO_CLOUD_STORAGE"
]
},
"exfiltration": {
"sources": [
{
"name": "//cloudsql.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_NAME",
"components": [
"Databases: DATABASE_NAME"
]
}
],
"targets": [
{
"name": "//storage.googleapis.com/TARGET_STORAGE_BUCKET_NAME",
"components": [
"TARGET_FILE_NAME"
]
}
]
},
"parentDisplayName": "Event Threat Detection",
"domains": [
{
"category": "AI"
},
{
"category": "IDENTITY_AND_ACCESS"
}
],
"logEntries": [
{
"cloudLoggingEntry": {
"insertId": "INSERT_ID",
"logId": "cloudaudit.googleapis.com/data_access",
"resourceContainer": "projects/PROJECT_ID",
"timestamp": "TIMESTAMP"
}
}
]
},
"resource": {
"name": "//cloudsql.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_NAME",
"displayName": "INSTANCE_NAME",
"type": "google.cloud.sql.Instance",
"cloudProvider": "GOOGLE_CLOUD_PLATFORM",
"service": "sqladmin.googleapis.com",
"location": "LOCATION",
"gcpMetadata": {
"project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
"projectDisplayName": "PROJECT_ID",
"parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
"parentDisplayName": "PROJECT_ID",
"organization": "organizations/ORGANIZATION_ID"
},
"resourcePath": {
"nodes": [
{
"nodeType": "GCP_PROJECT",
"id": "projects/PROJECT_NUMBER",
"displayName": "PROJECT_ID"
},
{
"nodeType": "GCP_ORGANIZATION",
"id": "organizations/ORGANIZATION_ID"
}
]
},
"resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_NUMBER"
},
"sourceProperties": {
"sourceId": {
"projectNumber": "PROJECT_NUMBER",
"customerOrganizationNumber": "ORGANIZATION_ID"
},
"detectionCategory": {
"ruleName": "agent_engine_cloudsql_exfil",
"subRuleName": "agent_engine_export_to_public_gcs"
},
"detectionPriority": "HIGH",
"affectedResources": [
{
"gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
},
{
"gcpResourceName": "//storage.googleapis.com/TARGET_STORAGE_BUCKET_NAME"
},
{
"gcpResourceName": "//cloudsql.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_NAME"
}
],
"evidence": [
{
"sourceLogId": {
"projectId": "PROJECT_ID",
"resourceContainer": "projects/PROJECT_ID",
"timestamp": {
"seconds": "TIMESTAMP_SECONDS",
"nanos": TIMESTAMP_NANOS
},
"insertId": "INSERT_ID",
"logId": "cloudaudit.googleapis.com/data_access"
}
}
],
"properties": {
"exportToGcs": {
"cloudsqlInstanceResource": "//cloudsql.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_NAME",
"gcsUri": "gs://TARGET_STORAGE_BUCKET_NAME/TARGET_FILE_NAME",
"bucketAccess": "PUBLICLY_ACCESSIBLE",
"bucketResource": "//storage.googleapis.com/TARGET_STORAGE_BUCKET_NAME",
"exportScope": "ONE_OR_MORE_DATABASES"
}
},
"findingId": "FINDING_ID",
"contextUris": {
"mitreUri": {
"displayName": "MITRE Link",
"url": "https://attack.mitre.org/techniques/T1567/002/"
},
"cloudLoggingQueryUri": [
{
"displayName": "Cloud Logging Query Link",
"url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%22TIMESTAMP%22%0AinsertId%3D%22INSERT_ID%22?project=PROJECT_ID"
}
]
},
"domains": [
{
"category": "AI"
},
{
"category": "IDENTITY_AND_ACCESS"
}
]
}
}
