Usar o Serviço de ações sensíveis

Esta página mostra como revisar as descobertas do Serviço de ações sensíveis no Google Cloud console e inclui exemplos dessas descobertas.

O Serviço de ações sensíveis é um serviço integrado do Security Command Center que detecta quando ações na sua Google Cloud organização, pastas e projetos que podem ser prejudiciais à sua empresa são feitas por uma pessoa mal-intencionada. Para saber mais, consulte Visão geral do Serviço de ações sensíveis.

Como analisar as descobertas do Serviço de ações sensíveis

O Serviço de ações sensíveis é sempre ativado quando você ativa o Security Command Center e não pode ser desativado. Para mais informações sobre os tipos de descoberta do Serviço de ações sensíveis, consulte Descobertas.

Quando o Serviço de ações sensíveis detecta uma ação considerada sensível, ele cria uma descoberta e uma entrada de registro. É possível visualizar a descoberta no Google Cloud console. É possível consultar as entradas de registro no Cloud Logging. Para testar o Serviço de ações sensíveis, execute uma ação sensível e verifique se a descoberta aparece na página Descobertas no Google Cloud console. Para mais informações, consulte Como testar o Serviço de ações sensíveis.

Como analisar as descobertas no Security Command Center

Os papéis do IAM para o Security Command Center podem ser concedidos no nível da organização, da pasta ou do projeto. A capacidade de visualizar, editar, criar ou atualizar descobertas, recursos e fontes de segurança depende do nível a que você tem acesso. Para saber mais sobre os papéis do Security Command Center, consulte Controle de acesso.

Para analisar as descobertas do Serviço de ações sensíveis no console, siga estas etapas:

Se a residência de dados estiver ativada na sua organização, acesse a página usando o console jurisdicional. Para mais informações, consulte Usar o console com a residência de dados ativada.

  1. No Google Cloud console do, acesse a página Descobertas do Security Command Center.

    Acessar descobertas

  2. Selecioneo seu Google Cloud projeto ou a organização.
  3. Na seção Filtros rápidos, na subseção Nome de exibição da origem, selecione Serviço de ações sensíveis. Os resultados da consulta de descobertas são atualizados para mostrar apenas as descobertas dessa fonte.
  4. Para visualizar os detalhes de uma descoberta específica, clique no nome dela na coluna Categoria. O painel de detalhes da descoberta é aberto e mostra a guia Resumo.
  5. Na guia Resumo, revise os detalhes da descoberta, incluindo informações sobre o que foi detectado, o recurso afetado e, se disponível, as etapas que você pode seguir para corrigir a descoberta.
  6. Opcional: para conferir a definição JSON completa da descoberta, clique na guia JSON.

Conferir as descobertas causadas pelo mesmo ator

Ao investigar se uma ação sensível foi realizada por um usuário mal-intencionado, considere pesquisar outras descobertas causadas por esse ator.

Para conferir todas as descobertas causadas pelo mesmo ator, siga estas etapas:

  1. Abra a descoberta e confira os detalhes dela.
  2. No Painel de detalhes da descoberta, copie o endereço de e-mail ao lado de E-mail principal.
  3. Fechar painel.

  4. No Editor de consultas, insira a seguinte consulta:

    access.principal_email="PRINCIPAL_EMAIL"

    Substitua PRINCIPAL_EMAIL pelo endereço de e-mail que você copiou anteriormente. O Security Command Center mostra todas as descobertas associadas a ações realizadas pelo ator especificado.

Como visualizar descobertas no Cloud Logging

O Serviço de ações sensíveis grava uma entrada de registro nos Google Cloud registros da plataforma para cada ação sensível que o serviço encontra. Essas entradas de registro são gravadas mesmo se você não tiver ativado o Security Command Center.

Para visualizar as entradas de registro de ações sensíveis no Cloud Logging, faça o seguinte:

  1. Acesse a Análise de registros no Google Cloud console do.

    Acessar a Análise de registros

  2. No Seletor de projetos na parte superior da página, escolha o projeto para o qual você quer ver as entradas de registro do Serviço de ações sensíveis. Como alternativa, para ver as entradas de registro no nível da organização, selecione a organização.

  3. Na caixa de texto Consulta, insira a seguinte definição de recurso: resource.type="sensitiveaction.googleapis.com/Location"

  4. Selecione Executar consulta. A tabela Resultados da consulta é atualizada com todas as entradas de registro correspondentes que foram gravadas no período da sua consulta.

  5. Para visualizar os detalhes de uma entrada de registro, clique em uma linha da tabela e em Expandir campos aninhados.

É possível criar consultas de registro avançadas para especificar um conjunto de entradas de registro a partir de qualquer número de registros.

Exemplos de formatos de descoberta

Esta seção inclui a saída JSON para as descobertas do Serviço de ações sensíveis conforme elas aparecem ao criar exportações do Google Cloud console ou executar métodos de lista na API Security Command Center.

Os exemplos de saída contêm os campos mais comuns a todas as descobertas. No entanto, é possível que nem todos os campos apareçam em todas as descobertas. A saída real que você vê depende da configuração de um recurso e do tipo e do estado das descobertas.

Para ver exemplos de descobertas, expanda um ou mais dos seguintes nós.

Evasão de defesa: alteração na política da organização

Essa descoberta não está disponível para envolvidos no projeto.

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {
              "regionCode": "US"
            },
            "serviceName": "orgpolicy.googleapis.com",
            "methodName": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
            "principalSubject": "user:PRINCIPAL_EMAIL"
          },
          "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Defense Evasion: Organization Policy Changed",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-27T12:35:30.466Z",
          "database": {},
          "eventTime": "2022-08-27T12:35:30.264Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "DEFENSE_EVASION",
            "primaryTechniques": [
              "IMPAIR_DEFENSES"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions",
          "resourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention",
          "display_name": "",
          "project_name": "",
          "project_display_name": "",
          "parent_name": "",
          "parent_display_name": "",
          "type": "",
          "folders": []
        },
        "sourceProperties": {
          "sourceId": {
            "organizationNumber": "ORGANIZATION_ID",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "change_organization_policy"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID"
            },
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
            },
            {
              "gcpResourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "resourceContainer": "organizations/ORGANIZATION_ID",
                "timestamp": {
                  "seconds": "1661603725",
                  "nanos": 12242032
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1562/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-27T12:35:25.012242032Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Evasão de defesa: remover administrador de faturamento

Essa descoberta não está disponível para envolvidos no projeto.

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {},
            "serviceName": "cloudresourcemanager.googleapis.com",
            "methodName": "SetIamPolicy",
            "principalSubject": "user:PRINCIPAL_EMAIL"
          },
          "assetDisplayName": "organizations/ORGANIZATION_ID",
          "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
          "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Defense Evasion: Remove Billing Admin",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-31T14:47:11.752Z",
          "database": {},
          "eventTime": "2022-08-31T14:47:11.256Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "iamBindings": [
            {
              "action": "REMOVE",
              "role": "roles/billing.admin",
              "member": "user:PRINCIPAL_ACCOUNT_CHANGED"
            }
          ],
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "DEFENSE_EVASION",
            "primaryTechniques": [
              "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions Service",
          "resourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
          "display_name": "ORGANIZATION_NAME",
          "project_name": "",
          "project_display_name": "",
          "parent_name": "",
          "parent_display_name": "",
          "type": "google.cloud.resourcemanager.Organization",
          "folders": []
        },
        "sourceProperties": {
          "sourceId": {
            "organizationNumber": "ORGANIZATION_ID",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "remove_billing_admin"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "resourceContainer": "organizations/ORGANIZATION_ID",
                "timestamp": {
                  "seconds": "1661957226",
                  "nanos": 356329000
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1578/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-31T14:47:06.356329Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Impacto: instância de GPU criada

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {
              "regionCode": "US"
            },
            "serviceName": "compute.googleapis.com",
            "methodName": "beta.compute.instances.insert"
          },
          "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Impact: GPU Instance Created",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-11T19:13:11.134Z",
          "database": {},
          "eventTime": "2022-08-11T19:13:09.885Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "IMPACT",
            "primaryTechniques": [
              "RESOURCE_HIJACKING"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions",
          "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
          "display_name": "VM_INSTANCE_NAME",
          "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "project_display_name": "PROJECT_ID",
          "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "parent_display_name": "PROJECT_ID",
          "type": "google.compute.Instance",
          "folders": [
            {
              "resourceFolderDisplayName": "FOLDER_NAME",
              "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
            }
          ]
        },
        "sourceProperties": {
          "sourceId": {
            "projectNumber": "PROJECT_NUMBER",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "gpu_instance_created"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
            },
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "projectId": "PROJECT_ID",
                "resourceContainer": "projects/PROJECT_ID",
                "timestamp": {
                  "seconds": "1660245184",
                  "nanos": 578768000
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1496/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-11T19:13:04.578768Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Impacto: muitas instâncias criadas

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIpGeo": {},
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.instances.insert",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Impact: Many Instances Created",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-22T21:18:18.112Z",
        "database": {},
        "eventTime": "2022-08-22T21:18:17.759Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "IMPACT",
          "primaryTechniques": [
            "RESOURCE_HIJACKING"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "display_name": "",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Instance",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "many_instances_created"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661203092",
                "nanos": 314642000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1496/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-22T21:18:12.314642Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Impacto: várias instâncias excluídas

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIpGeo": {},
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.instances.delete",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Impact: Many Instances Deleted",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-22T21:21:11.432Z",
        "database": {},
        "eventTime": "2022-08-22T21:21:11.144Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "IMPACT",
          "primaryTechniques": [
            "DATA_DESTRUCTION"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "display_name": "VM_INSTANCE_NAME",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Instance",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "many_instances_deleted"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661203265",
                "nanos": 669160000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1485/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-22T21:21:05.669160Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Persistência: adicionar papel sensível

Essa descoberta não está disponível para envolvidos no projeto.

{
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIp": "PRINCIPAL_IP_ADDRESS",
          "callerIpGeo": {},
          "serviceName": "cloudresourcemanager.googleapis.com",
          "methodName": "SetIamPolicy",
          "principalSubject": "user:PRINCIPAL_EMAIL"
        },
        "assetDisplayName": "organizations/ORGANIZATION_ID",
        "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
        "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
        "category": "Persistence: Add Sensitive Role",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-31T17:20:13.305Z",
        "database": {},
        "eventTime": "2022-08-31T17:20:11.929Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "iamBindings": [
          {
            "action": "ADD",
            "role": "roles/editor",
            "member": "user:PRINCIPAL_ACCOUNT_CHANGED"
          }
        ],
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "PERSISTENCE",
          "primaryTechniques": [
            "ACCOUNT_MANIPULATION"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
        "parentDisplayName": "Sensitive Actions Service",
        "resourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions Service",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
        "display_name": "ORGANIZATION_NAME",
        "project_name": "",
        "project_display_name": "",
        "parent_name": "",
        "parent_display_name": "",
        "type": "google.cloud.resourcemanager.Organization",
        "folders": []
      },
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "add_sensitive_role"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1661966410",
                "nanos": 132148000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-31T17:20:10.132148Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Persistência: chave SSH do projeto adicionada

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIp": "PRINCIPAL_IP_ADDRESS",
          "callerIpGeo": {
            "regionCode": "US"
          },
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.projects.setCommonInstanceMetadata",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Persistence: Project SSH Key Added",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-25T13:24:43.142Z",
        "database": {},
        "eventTime": "2022-08-25T13:24:42.719Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "PERSISTENCE",
          "primaryTechniques": [
            "ACCOUNT_MANIPULATION",
            "SSH_AUTHORIZED_KEYS"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID",
        "display_name": "PROJECT_ID",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Project",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "add_ssh_key"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661433879",
                "nanos": 413362000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/004/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-25T13:24:39.413362Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

A seguir