このページでは、Security Command Center の組み込みサービスである Sensitive Actions Service の概要について説明します。このサービスは、 Google Cloud組織、フォルダ、プロジェクトで悪意のある行為者により行われた場合にビジネスに損害を与える可能性のあるアクションを検出します。
Sensitive Actions Service で検出されるアクションのほとんどは、正規のユーザーによって正当な目的で実行されるもので、脅威となるものではありません。ただし、Sensitive Actions Service が正しい判定を行うとは限りません。検出結果を調査して検出結果が脅威でないことを確認する必要があります。
Sensitive Actions Service の仕組み
Sensitive Actions Service は、組織の管理アクティビティ監査ログに記録された機密性の高いアクションを自動的にモニタリングします。管理アクティビティ監査ログは常時有効になっています。このログを有効にしたり、構成する必要はありません。
Sensitive Actions Service は、Google アカウントによって実行された機密性の高いアクションを検出すると、検出結果を Google Cloud コンソールの Security Command Center に書き込みます。さらに、ログエントリを Google Cloud Platform のログに書き込みます。
以降のセクションでは、Sensitive Actions Service に適用される制限事項について説明します。
アカウント サポート
Sensitive Actions Service の検出対象は、ユーザー アカウントによって実行されるアクションに限定されています。
暗号化とデータ所在地の制限
機密性の高いアクションを検出するには、Sensitive Actions Service が組織の管理アクティビティ監査ログを分析できる必要があります。
組織で顧客管理の暗号鍵（CMEK）を使用してログを暗号化している場合、Sensitive Actions Service はログを読み取ることができず、機密性の高いアクションが発生してもアラートを送信することはできません。
管理アクティビティ監査ログのログバケットのロケーションを global ロケーション以外に構成している場合、機密性の高いアクションは検出できません。たとえば、特定のプロジェクト、フォルダ、または組織内の _Required ログバケットのストレージのロケーションを指定している場合、そのプロジェクト、フォルダのログ。または組織では機密性の高いアクションをスキャンできません。
Sensitive Actions Service の検出結果
次の表に、Sensitive Actions Service で生成される検出結果のカテゴリを示します。各検出結果の表示名は、検出されたアクションに使用できる MITRE ATT&CK 戦術で始まります。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-04-28 UTC。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis page provides an overview of Sensitive Actions Service, a built-in service of\nSecurity Command Center that detects when actions are taken in your Google Cloud\norganization, folders, and projects that could be damaging to your business if\nthey are taken by a malicious actor.\n\nIn most cases, the actions that are detected by Sensitive Actions Service\ndo not represent threats, because they are taken by legitimate users\nfor legitimate purposes. However, the Sensitive Actions Service cannot\nconclusively determine legitimacy, so you might need to investigate the\nfindings before you can be sure that they don't represent a threat.\n\nHow Sensitive Actions Service works\n\nSensitive Actions Service automatically monitors all of your organization's\n[Admin Activity audit logs](/logging/docs/audit#admin-activity)\nfor sensitive actions. Admin Activity audit logs are always on, so you do\nnot need to enable or otherwise configure them.\n\nWhen Sensitive Actions Service detects a sensitive action that is taken by a\n[Google account](/iam/docs/overview#google_account),\nSensitive Actions Service\nwrites a finding to Security Command Center in the Google Cloud console\nand a log entry to the [Google Cloud platform\nlogs](/logging/docs/api/platform-logs#sensitive_actions_service).\n\nSensitive Actions Service findings are classified as *observations* and can be\nviewed by finding class or finding source on the **Findings** tab in the\n[Security Command Center console](https://console.cloud.google.com/security/command-center/findings).\n\nRestrictions\n\nThe following sections describe restrictions that apply to Sensitive Actions Service.\n\nAccount support\n\nSensitive Actions Service detection is limited to actions taken by user\naccounts.\n\nEncryption and data residency restrictions\n\nTo detect sensitive actions, Sensitive Actions Service must be able to analyze\nyour organization's [Admin Activity audit logs](/logging/docs/audit#admin-activity).\n\nIf your organization encrypts your logs by using customer-managed encryption\nkeys (CMEK) to encrypt your logs, Sensitive Actions Service cannot read your logs\nand, consequently, cannot alert you when sensitive actions occur.\n\nSensitive actions cannot be detected if you have configured the location of the\nlog bucket for your your Admin Activity Audit Logs to be in a location other\nthan the `global` location. For example, if you have [specified a storage\nlocation](/logging/docs/default-settings#specify-region) for the `_Required`\nlogs bucket in a certain project, folder, or organization, logs from that\nproject, folder, or organization cannot be scanned for sensitive actions.\n\nSensitive Actions Service findings\n\nThe following table shows the finding categories that Sensitive Actions Service\ncan produce. The display name for each finding starts with the [MITRE\nATT\\&CK tactic](https://attack.mitre.org)\nthat the detected action could be used for.\n\n| Display name | API name | Description |\n|------------------------------------------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `Defense Evasion: Organization Policy Changed` | `change_organization_policy` | An organization-level organization policy was created, updated, or deleted, in an organization that is more than 10 days old. This finding isn't available for project-level activations. |\n| `Defense Evasion: Remove Billing Admin` | `remove_billing_admin` | An organization-level billing administrator IAM role was removed, in an organization that is more than 10 days old. |\n| `Impact: GPU Instance Created` | `gpu_instance_created` | A GPU instance was created, where the creating principal has not created a GPU instance in the same project recently. |\n| `Impact: Many Instances Created` | `many_instances_created` | Many instances were created in a project by the same principal in one day. |\n| `Impact: Many Instances Deleted` | `many_instances_deleted` | Many instances were deleted in a project by the same principal in one day. |\n| `Persistence: Add Sensitive Role` | `add_sensitive_role` | A sensitive or highly-privileged organization-level IAM role was granted in an organization that is more than 10 days old. This finding isn't available for project-level activations. |\n| `Persistence: Project SSH Key Added` | `add_ssh_key` | A project-level SSH key was created in a project, for a project that is more than 10 days old. |\n\nWhat's next\n\n- Learn about [using Sensitive Actions Service](/security-command-center/docs/how-to-use-sensitive-actions).\n- Learn how to [investigate and develop response plans](/security-command-center/docs/how-to-investigate-threats) for threats."]]
