當 Sensitive Actions Service 偵測到Google 帳戶執行的敏感動作時，Sensitive Actions Service 會在 Google Cloud 控制台的 Security Command Center 中寫入發現項目，並在Google Cloud 平台記錄中寫入記錄項目。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis page provides an overview of Sensitive Actions Service, a built-in service of\nSecurity Command Center that detects when actions are taken in your Google Cloud\norganization, folders, and projects that could be damaging to your business if\nthey are taken by a malicious actor.\n\nIn most cases, the actions that are detected by Sensitive Actions Service\ndo not represent threats, because they are taken by legitimate users\nfor legitimate purposes. However, the Sensitive Actions Service cannot\nconclusively determine legitimacy, so you might need to investigate the\nfindings before you can be sure that they don't represent a threat.\n\nHow Sensitive Actions Service works\n\nSensitive Actions Service automatically monitors all of your organization's\n[Admin Activity audit logs](/logging/docs/audit#admin-activity)\nfor sensitive actions. Admin Activity audit logs are always on, so you do\nnot need to enable or otherwise configure them.\n\nWhen Sensitive Actions Service detects a sensitive action that is taken by a\n[Google account](/iam/docs/overview#google_account),\nSensitive Actions Service\nwrites a finding to Security Command Center in the Google Cloud console\nand a log entry to the [Google Cloud platform\nlogs](/logging/docs/api/platform-logs#sensitive_actions_service).\n\nSensitive Actions Service findings are classified as *observations* and can be\nviewed by finding class or finding source on the **Findings** tab in the\n[Security Command Center console](https://console.cloud.google.com/security/command-center/findings).\n\nRestrictions\n\nThe following sections describe restrictions that apply to Sensitive Actions Service.\n\nAccount support\n\nSensitive Actions Service detection is limited to actions taken by user\naccounts.\n\nEncryption and data residency restrictions\n\nTo detect sensitive actions, Sensitive Actions Service must be able to analyze\nyour organization's [Admin Activity audit logs](/logging/docs/audit#admin-activity).\n\nIf your organization encrypts your logs by using customer-managed encryption\nkeys (CMEK) to encrypt your logs, Sensitive Actions Service cannot read your logs\nand, consequently, cannot alert you when sensitive actions occur.\n\nSensitive actions cannot be detected if you have configured the location of the\nlog bucket for your your Admin Activity Audit Logs to be in a location other\nthan the `global` location. For example, if you have [specified a storage\nlocation](/logging/docs/default-settings#specify-region) for the `_Required`\nlogs bucket in a certain project, folder, or organization, logs from that\nproject, folder, or organization cannot be scanned for sensitive actions.\n\nSensitive Actions Service findings\n\nThe following table shows the finding categories that Sensitive Actions Service\ncan produce. The display name for each finding starts with the [MITRE\nATT\\&CK tactic](https://attack.mitre.org)\nthat the detected action could be used for.\n\n| Display name | API name | Description |\n|------------------------------------------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `Defense Evasion: Organization Policy Changed` | `change_organization_policy` | An organization-level organization policy was created, updated, or deleted, in an organization that is more than 10 days old. This finding isn't available for project-level activations. |\n| `Defense Evasion: Remove Billing Admin` | `remove_billing_admin` | An organization-level billing administrator IAM role was removed, in an organization that is more than 10 days old. |\n| `Impact: GPU Instance Created` | `gpu_instance_created` | A GPU instance was created, where the creating principal has not created a GPU instance in the same project recently. |\n| `Impact: Many Instances Created` | `many_instances_created` | Many instances were created in a project by the same principal in one day. |\n| `Impact: Many Instances Deleted` | `many_instances_deleted` | Many instances were deleted in a project by the same principal in one day. |\n| `Persistence: Add Sensitive Role` | `add_sensitive_role` | A sensitive or highly-privileged organization-level IAM role was granted in an organization that is more than 10 days old. This finding isn't available for project-level activations. |\n| `Persistence: Project SSH Key Added` | `add_ssh_key` | A project-level SSH key was created in a project, for a project that is more than 10 days old. |\n\nWhat's next\n\n- Learn about [using Sensitive Actions Service](/security-command-center/docs/how-to-use-sensitive-actions).\n- Learn how to [investigate and develop response plans](/security-command-center/docs/how-to-investigate-threats) for threats."]]
