持續性：高強度驗證已停用

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

如果您與 Cloud Logging 共用 Google Workspace 記錄，Event Threat Detection 會針對多種 Google Workspace 威脅產生調查結果。由於 Google Workspace 記錄檔位於機構層級，因此只有在機構層級啟用 Security Command Center 時，Event Threat Detection 才能掃描這些記錄檔。

Event Threat Detection 會擴充記錄事件，並將發現結果寫入 Security Command Center。下表說明 Google Workspace 威脅發現類型、與這項發現項目相關的 MITRE ATT&CK 框架項目，以及觸發這項發現項目的事件詳細資料。您也可以使用特定篩選器檢查記錄，並彙整所有收集到的資訊，以回應這項發現項目。

Event Threat Detection 是這項發現項目的來源。

如果您在專案層級啟用 Security Command Center，就無法使用這項發現項目。

說明 動作
機構已停用兩步驟驗證。 貴機構不再需要兩步驟驗證。確認這是管理員有意變更政策，還是有心人士試圖藉此更容易盜用帳戶。

使用下列篩選器檢查記錄：

protopayload.resource.labels.service="admin.googleapis.com"

logName="organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity

將 ORGANIZATION_ID 替換為組織 ID。

研究觸發這項發現的事件：

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
  "finding": {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//admin.googleapis.com/organizations/ORGANIZATION_ID/securitySettings",
    "state": "ACTIVE",
    "category": "Persistence: Strong Authentication Disabled",
    "sourceProperties": {
      "sourceId": {
        "organizationNumber": "ORGANIZATION_ID",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "technique": "impair_defenses",
        "indicator": "audit_log",
        "ruleName": "enforce_strong_authentication"
      },
      "detectionPriority": "MEDIUM",
      "affectedResources": [{
        "gcpResourceName": "//admin.googleapis.com/organizations/ORGANIZATION_ID/securitySettings"
      }, {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
      }],
      "evidence": [{
        "sourceLogId": {
          "resourceContainer": "organizations/ORGANIZATION_ID",
          "timestamp": {
            "seconds": "1623952110",
            "nanos": 6.51337E8
          },
          "insertId": "INSERT_ID"
        }
      }],
      "properties": {
        "serviceName": "admin.googleapis.com",
        "methodName": "google.admin.AdminService.enforceStrongAuthentication",
        "principalEmail": "PRINCIPAL_EMAIL"
      },
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "https://attack.mitre.org/techniques/T1562/"
        },
        "cloudLoggingQueryUri": [{
          "displayName": "Cloud Logging Query Link",
          "url": "https://console.cloud.google.com/logs/query;query\u003dtimestamp%3D%222021-06-17T17:48:30.651337Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\u003d"
        }],
"workspacesUri": {
          "displayName": "Workspaces Link",
          "url": "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION"
        }
      }
    },
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2021-06-17T17:48:30.651Z",
    "createTime": "2021-06-17T17:48:33.574Z",
    "severity": "MEDIUM",
    "workflowState": "NEW",
    "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "findingClass": "THREAT"
  },
  "resource": {
    "name": "//admin.googleapis.com/organizations/ORGANIZATION_ID/securitySettings"
  }
}

後續步驟