threat-prevention 유형의 보안 프로필을 만들면 기본 심각도와 관련 작업이 있는 다음 기본 위협 서명이 프로필에 추가됩니다.
취약점 감지 서명
스파이웨어 방지 서명
바이러스 백신 서명
DNS 서명
보안 프로필에 심각도 재정의를 추가할 수 있습니다. 각 기본 서명에는 위협 심각도 수준이 있습니다.
심각도 수준은 감지된 위협의 위험을 나타냅니다. 각 심각도 수준에는 연결된 기본 작업도 있습니다. 기본 작업은 Cloud NGFW가 특정 심각도 수준의 위협을 처리하기 위해 취하는 조치를 지정합니다. 보안 프로필을 사용하여 심각도 수준의 기본 작업을 재정의할 수 있습니다.
지원되는 작업은 다음과 같습니다.
재정의 없음: 위협과 연결된 기본 작업 수행
거부: 위협 로깅 및 패킷 삭제
알림: 위협 로깅 및 세션 허용
허용: 위협이 감지되면 무시
보안 프로필을 만들 때 모든 심각도 수준의 기본 재정의 작업은 No override으로 설정됩니다.
보안 프로필에 서명 재정의도 추가할 수 있습니다. 각 위협 서명에는 연결된 기본 작업이 있습니다. 보안 프로필을 사용하여 이전 작업으로 위협 서명의 기본 작업을 재정의할 수 있습니다. 참고: 서명 재정의는 심각도 재정의보다 우선 적용됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-04-30(UTC)"],[[["\u003cp\u003eSecurity profiles are organizational-level resources that define Layer 7 inspection policies for Google Cloud resources, enabling services like intrusion prevention by scanning intercepted traffic.\u003c/p\u003e\n"],["\u003cp\u003eCloud Next Generation Firewall (NGFW) supports threat prevention security profiles, which include default threat signatures such as vulnerability detection, anti-spyware, antivirus, and DNS signatures.\u003c/p\u003e\n"],["\u003cp\u003eSecurity profiles can override default actions for threat severity levels or specific threat signatures, with signature overrides taking precedence over severity overrides.\u003c/p\u003e\n"],["\u003cp\u003eEach security profile is uniquely identified by a URL that includes the organization ID, location (always set to global), and the security profile name, following a specific format.\u003c/p\u003e\n"],["\u003cp\u003eIdentity and Access Management (IAM) roles determine the ability to create, modify, view, or use security profiles, with the Security Profile Admin role being required for creating and modifying them.\u003c/p\u003e\n"]]],[],null,["# Security profile overview\n\nSecurity profiles help you define Layer 7 inspection policy for your\nGoogle Cloud resources. They are generic policy structures\nthat are used by firewall endpoints to scan intercepted traffic to provide\napplication Layer services, such as intrusion detection and prevention.\n\nThis document provides a detailed overview of security profiles and their\ncapabilities.\n\nSpecifications\n--------------\n\n- A security profile is an organizational level resource.\n\n- Cloud Next Generation Firewall supports security profiles of type `threat prevention`.\n\n- Each security profile is uniquely identified by a URL with\n the following elements:\n\n - **Organization ID:** ID of the organization.\n - **Location:** scope of security profile. Location is always set to `global`.\n - **Name:** security profile name in the following format:\n - A string 1-63 characters long\n - Includes only alphanumeric characters or hyphens (-)\n - Must not start with a number\n- To construct a unique URL identifier for a security profile,\n use the following format:\n\n organization/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/securityProfiles/\u003cvar translate=\"no\"\u003eSECURITY_PROFILE_NAME\u003c/var\u003e\n\n For example, a `global` security profile `example-security-profile`\n in organization `2345678432` has the following unique identifier: \n\n organization/2345678432/locations/global/securityProfiles/example-security-profile\n\n- After you create a security profile, you have the option to attach it\n to a [security profile group](/firewall/docs/about-security-profile-groups)\n or to attach it later.\n This security profile group is referenced by the firewall policy of the\n Virtual Private Cloud (VPC) network where you want to enforce Layer 7 inspection.\n\n- Each security profile must have an associated project ID. The associated\n project is used for quotas and access restrictions on security profile\n resources. If you authenticate your service account by using the\n [`gcloud auth activate-service-account` command](/sdk/gcloud/reference/auth/activate-service-account),\n you can associate your service account with the security profile.\n To learn more about how to create a security profile,\n see [Create and manage security profiles](/firewall/docs/configure-security-profiles#create-security-profile).\n\nThreat prevention security profile\n----------------------------------\n\nCloud NGFW uses threat prevention security profiles to provide\n[intrusion detection and prevention service](/firewall/docs/about-intrusion-prevention).\n\nWhen you create a security profile of type `threat-prevention`, the following\n[default threat signatures](/firewall/docs/about-threats#default_signature_set)\nwith default severity and associated actions are added to the profile:\n\n- Vulnerability detection signatures\n- Anti-spyware signatures\n- Antivirus signatures\n- DNS signatures\n\nYou have the option to add severity overrides to your security profiles. Each\ndefault signature has a [threat severity level](/firewall/docs/about-threats#threat-severity-level).\nThe severity level indicates the risk of the detected threat. Each severity\nlevel also has an associated default action. The default action specifies the\nmeasures Cloud NGFW takes to handle threats with a specific\nseverity level. You can use security profiles to override the default action\nfor a severity level.\n\nThe following actions are supported:\n\n- **No override**: performs the default action associated with the threat.\n- **Deny**: logs the threat and drops the packet.\n- **Alert**: logs the threat and allows the session.\n- **Allow**: ignores the threat, if detected.\n\nWhen you create a security profile, the default override action for all\nseverity levels is set to `No override`.\n\nYou can also add signature overrides to your security profiles. Each threat\nsignature has an associated default action. You can use security profiles to\noverride the default actions of the threat signatures by using the preceding\nactions. Signature overrides take precedence over severity overrides.\n| **Note:** If you override the default threat signature action or modify the default severity level action in a security profile, it might take up to 15 minutes for these changes to take effect.\n\nTo learn more about how to configure threat prevention, see\n[Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention).\n\nIdentity and Access Management roles\n------------------------------------\n\nIdentity and Access Management (IAM) roles govern the following security profiles actions:\n\n- Creating a security profile in an organization\n- Modifying or deleting a security profile\n- Viewing details of a security profile\n- Viewing a list of security profiles in an organization\n- Using a security profile in a security profile group\n\nThe following table describes the roles that are necessary for each step.\n\nQuotas\n------\n\nTo view quotas associated with security profiles, see [Quotas and limits](/firewall/docs/quotas).\n\nPricing\n-------\n\nPricing for security profiles is described in [Cloud NGFW pricing](/firewall/pricing).\n\nWhat's next\n-----------\n\n- [Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention)\n- [Create and manage security profiles](/firewall/docs/configure-security-profiles)"]]
