本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。
總覽
AI 代理程式在多種方法和服務中，反覆觸發「權限遭拒」錯誤。
Event Threat Detection 是這項發現項目的來源。
回應方式
如要回應這項發現項目，請按照下列步驟操作：
步驟 1：查看調查結果詳細資料
- 按照「查看發現項目」一文的說明，開啟
Initial Access: AI Agent Identity Excessive Permission Denied Actions發現項目。 在「摘要」分頁的發現項目詳細資料中，記下下列欄位的值。
「偵測到的內容」下方會顯示以下資訊：
- 主體電子郵件地址：觸發多個權限遭拒錯誤的主體
- 服務名稱：發生上次權限遭拒錯誤的 Google Cloud 服務 API 名稱
- 方法名稱：發生上次權限遭拒錯誤時呼叫的方法
在發現項目詳細資料的「來源屬性」分頁中，記下 JSON 中下列欄位的值：
- properties.failedActions：發生的權限遭拒錯誤。 每個項目都會顯示服務名稱、方法名稱、失敗嘗試次數，以及上次發生錯誤的時間。最多顯示 10 個項目。
步驟 2：檢查記錄
- 前往 Google Cloud 控制台的「Logs Explorer」(記錄檔探索工具)，方法是點選「Cloud Logging URI」(Cloud Logging URI) 中的連結。
- 在 Google Cloud 控制台工具列中選取專案。
在隨即載入的頁面中，使用下列篩選器找出相關記錄：
protoPayload.authenticationInfo.principalEmail="PRINCIPAL_EMAIL"protoPayload.status.code=7
將 PRINCIPAL_EMAIL 換成您在調查結果詳細資料的「Principal email」欄位中記下的值。
步驟 3：研究攻擊和回應方法
- 查看這類發現項目的 MITRE ATT&CK 框架項目： 有效帳戶：雲端帳戶。
- 如要制定回應計畫，請將調查結果與 MITRE 研究結合。
步驟 4：實作回應
下列應變計畫可能適用於這項發現，但也可能影響作業。 請仔細評估調查期間收集到的資訊，找出解決問題的最佳方式。
- 請與「Principal email」(主體電子郵件地址) 欄位中的帳戶擁有者聯絡。確認正當擁有者是否執行了該項操作。
- 刪除該帳戶建立的專案資源，例如不熟悉的 Compute Engine 執行個體、快照、服務帳戶和 IAM 使用者等。
- 與擁有該帳戶的專案擁有者聯絡，並視情況刪除或停用該帳戶。
發現項目 JSON 範例
以下是發現項目 JSON 的範例，省略了預設值。
{ "finding": { "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID", "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global", "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER", "state": "ACTIVE", "category": "Initial Access: AI Agent Identity Excessive Permission Denied Actions", "securityMarks": { "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID/securityMarks" }, "eventTime": "TIMESTAMP", "createTime": "TIMESTAMP", "severity": "MEDIUM", "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID", "findingClass": "THREAT", "contacts": { "security": { "contacts": [ { "email": "USER_EMAIL" } ] }, "technical": { "contacts": [ { "email": "USER_EMAIL" } ] } }, "access": { "callerIp": "IP_ADDRESS", "callerIpGeo": { "regionCode": "COUNTRY_CODE" }, "userAgent": "USER_AGENT", "serviceName": "SERVICE_NAME", "methodName": "METHOD_NAME", "principalSubject": "principal://agents.global.org-ORGANIZATION_ID.system.id.goog/resources/aiplatform/projects/PROJECT_NUMBER/locations/LOCATION/reasoningEngines/REASONING_ENGINE_ID" }, "mitreAttack": { "primaryTactic": "INITIAL_ACCESS", "primaryTechniques": [ "VALID_ACCOUNTS", "CLOUD_ACCOUNTS" ] }, "parentDisplayName": "Event Threat Detection", "domains": [ { "category": "AI" }, { "category": "IDENTITY_AND_ACCESS" } ], "logEntries": [ { "cloudLoggingEntry": { "insertId": "INSERT_ID", "logId": "cloudaudit.googleapis.com/activity", "resourceContainer": "projects/PROJECT_ID", "timestamp": "TIMESTAMP" } } ] }, "resource": { "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER", "displayName": "PROJECT_ID", "type": "google.cloud.resourcemanager.Project", "cloudProvider": "GOOGLE_CLOUD_PLATFORM", "service": "cloudresourcemanager.googleapis.com", "gcpMetadata": { "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER", "projectDisplayName": "PROJECT_ID", "parent": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID", "parentDisplayName": "FOLDER_NAME", "folders": [ { "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID", "resourceFolderDisplayName": "FOLDER_NAME" } ], "organization": "organizations/ORGANIZATION_ID" }, "resourcePath": { "nodes": [ { "nodeType": "GCP_PROJECT", "id": "projects/PROJECT_NUMBER", "displayName": "PROJECT_ID" }, { "nodeType": "GCP_FOLDER", "id": "folders/FOLDER_ID", "displayName": "FOLDER_NAME" }, { "nodeType": "GCP_ORGANIZATION", "id": "organizations/ORGANIZATION_ID" } ] }, "resourcePathString": "organizations/ORGANIZATION_ID/folders/FOLDER_ID/projects/PROJECT_NUMBER" }, "sourceProperties": { "sourceId": { "projectNumber": "PROJECT_NUMBER", "customerOrganizationNumber": "ORGANIZATION_ID" }, "detectionCategory": { "ruleName": "agent_engine_excessive_failed_attempt" }, "detectionPriority": "MEDIUM", "affectedResources": [ { "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER" } ], "evidence": [ { "sourceLogId": { "projectId": "PROJECT_ID", "resourceContainer": "projects/PROJECT_ID", "timestamp": { "seconds": "TIMESTAMP_SECONDS", "nanos": TIMESTAMP_NANOS }, "insertId": "INSERT_ID", "logId": "cloudaudit.googleapis.com/activity" } } ], "properties": { "failedActions": [ { "methodName": "METHOD_NAME", "serviceName": "SERVICE_NAME", "attemptTimes": "TIMES", "lastOccurredTime": "TIMESTAMP" }, { "methodName": "METHOD_NAME", "serviceName": "SERVICE_NAME", "attemptTimes": "TIMES", "lastOccurredTime": "TIMESTAMP" } ] }, "findingId": "FINDING_ID", "contextUris": { "mitreUri": { "displayName": "MITRE Link", "url": "https://attack.mitre.org/techniques/T1078/004/" }, "cloudLoggingQueryUri": [ { "displayName": "Cloud Logging Query Link", "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%22TIMESTAMP%22%0AinsertId%3D%22INSERT_ID%22?project=PROJECT_ID" } ] }, "domains": [ { "category": "AI" }, { "category": "IDENTITY_AND_ACCESS" } ] } }
後續步驟
- 瞭解如何在 Security Command Center 中處理威脅調查結果。
- 請參閱威脅發現項目索引。
- 瞭解如何透過 Google Cloud 控制台查看發現項目。
- 瞭解產生威脅發現項目的服務。