Event Threat Detection conceptual overview

Important: This feature is available only for Security Command Center Premium tier.

What is Event Threat Detection?

Event Threat Detection is a built-in service for the Security Command Center Premium tier that continuously monitors your organization and identifies threats within your systems in near-real time. Event Threat Detection is regularly updated with new detectors to identify emerging threats at cloud scale.

How Event Threat Detection works

Event Threat Detection monitors your organization's Cloud Logging stream and consumes logs for one or more projects as they become available. Log entries contain status and event information that Event Threat Detection uses to quickly detect threats. Event Threat Detection applies detection logic and proprietary threat intelligence to the granular information contained in logs. When Event Threat Detection detects a threat, it writes a finding to Security Command Center and to a Cloud Logging project.

From Cloud Logging, you can export findings to other systems with Pub/Sub and process them with Cloud Functions.

Note: If you are using the Security Command Center Legacy UI, a pre-GA version of the product for users who have not subscribed to the Premium or Standard tier, you need to configure Event Threat Detection to select the resources you want to monitor, the rules you want to apply, and the storage location for logs.

Rules

Rules define the type of threats that Event Threat Detection detects. Currently, Event Threat Detection includes the following default rules:

Display name	API name	Log source types	Description
Exfiltration to external table	org_exfiltration	Cloud Audit Logs	Detection of resources owned by the protected organization that are saved outside of the organization, including copy or transfer operations.
VPC perimeter violation	vpc_perimeter_violation	Cloud Audit Logs	Detection of attempts to access BigQuery resources that are protected by VPC Service Controls.
Malware: bad domain	malware_bad_domain	Virtual Private Cloud (VPC) flow log Cloud DNS log	Detection of malware based on a connection to, or a lookup of, a known bad domain.
Malware: bad IP	malware_bad_ip	VPC flow log Firewall Rules log	Detection of malware based on a connection to a known bad IP address.
Cryptomining: pool domain	cryptomining_pool_domain	VPC flow log Cloud DNS log	Detection of cryptomining based on a connection to, or a lookup of, a known mining domain.
Cryptomining: pool IP	cryptomining_pool_ip	VPC flow log Firewall Rules log	Detection of cryptomining based on a connection to a known mining IP address.
Brute force SSH	brute_force_ssh	syslog	Detection of successful brute force of SSH on a host.
Outgoing DoS	outgoing_dos	VPC flow log	Detection of outgoing denial of service traffic.
IAM: Anomalous grant	iam_anomalous_grant	Cloud Audit Logs	Detection of privileges granted to Identity and Access Management (IAM) users and service accounts that are not members of the organization. Note: currently, this finding is only triggered for Security Command Center users with a gmail.com email address.

To create custom detection rules, you can store your log data in BigQuery, and then run unique or recurring SQL queries that capture your threat models.

Log types

Event Threat Detection relies on logs generated by Google Cloud. Logs are off by default, letting you decide which logs should be generated and what products can access them. However, to use Event Threat Detection, you must turn on logs for your organization, folders, and projects where you want Event Threat Detection to have full visibility.

Currently, Event Threat Detection consumes logs from the following Google Cloud sources. Follow the instructions at the links below to enable logs for each source.

• SSH logs/syslog
• VPC flow logs
• Cloud Audit Logs
• Cloud DNS logs
• Firewall Rules logs

Activating Virtual Private Cloud flow logs

Event Threat Detection analyzes Virtual Private Cloud (VPC) flow logs for malware, phishing, cryptomining, outbound DDoS, and outbound port-scanning detections. Event Threat Detection works best when VPC flow logging is active. Learn more about VPC Flow Logs.

Event Threat Detection works best with frequent sampling and brief aggregation intervals. If you set lower sampling rates or longer aggregation intervals, there can be a delay between the occurrence and the detection of an event. This delay can make it harder to evaluate possible malware, cryptomining, or phishing traffic increases.

Activating Cloud DNS logs

Event Threat Detection analyzes DNS logs for malware, phishing, and cryptomining detections. Event Threat Detection works best when Cloud DNS logging is active. Learn more about Cloud DNS logs.

What's next

• Learn about using Event Threat Detection.