Dampak: Cadangan Google Cloud Backup and DR Dihapus

Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh pendeteksi ancaman saat mendeteksi potensi ancaman di resource cloud Anda. Untuk mengetahui daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.

Ringkasan

Event Threat Detection memeriksa log audit untuk mendeteksi apakah cadangan yang disimpan di vault cadangan telah dihapus.

Event Threat Detection adalah sumber temuan ini.

Cara merespons

Untuk menanggapi temuan ini, lakukan hal berikut:

Langkah 1: Tinjau detail temuan

  1. Buka Impact: Deleted Google Cloud Backup and DR Backup temuan, seperti yang dijelaskan dalam Meninjau temuan. Panel detail untuk temuan akan terbuka di tab Ringkasan.
  2. Di tab Ringkasan, tinjau informasi di bagian berikut:
    • Apa yang terdeteksi, terutama kolom berikut:
      • Deskripsi: informasi tentang deteksi.
      • Subjek utama: pengguna atau akun layanan yang telah berhasil mengeksekusi tindakan.
    • Resource yang terpengaruh
      • Nama tampilan resource: project tempat frekuensi pencadangan dikurangi.
    • Link terkait, terutama kolom berikut:
      • Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK.
      • URI Logging: link untuk membuka Logs Explorer.

Langkah 2: Meneliti metode serangan dan respons

Hubungi pemilik akun layanan di kolom Principal subject dan konfirmasi apakah mereka melakukan tindakan tersebut.

Contoh JSON temuan

Berikut adalah contoh JSON temuan.

{
  "finding": {
    "access": {
      "principalEmail": "USER_EMAIL",
      "callerIp": "CALLER_IP",
      "callerIpGeo": {
        "regionCode": "REGION_CODE"
      },
      "serviceName": "backupdr.googleapis.com",
      "methodName": "google.cloud.backupdr.v1.BackupDR.DeleteBackup",
      "principalSubject": "user:USER_EMAIL"
    },
    "attackExposure": {},
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/FINDING_LOCATION/findings/FINDING_ID",
    "category": "Impact: Deleted Google Cloud Backup and DR Backup",
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "createTime": "EVENT_TIMESTAMP",
    "database": {},
    "description": "A backup stored in a backup vault has been manually deleted. The backup was stored in REGION",
    "eventTime": "EVENT_TIMESTAMP",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "DATA_DESTRUCTION"
      ]
    },
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "severity": "MEDIUM",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "display_name": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "project_display_name": "PROJECT_ID",
    "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parent_display_name": "FOLDER_NAME",
    "folders": []
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "backup_delete_vault_backup"
    },
    "detectionPriority": "HIGH",
    "affectedResources": [
      {
        "gcpResourceName": "//backupdr.googleapis.com/projects/PROJECT_NUMBER/locations/REGION/backupVaults/VAULT_ID/dataSources/DATA_SOURCE_NAME/backups/BACKUP_ID"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "0",
            "nanos": 0.0
          },
          "insertId": "INSERT_ID"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1485/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    },
    "description": "A backup stored in a backup vault has been manually deleted. The backup was stored in REGION"
  }
}

Langkah berikutnya