Security Health Analytics 的自定义模块概览

本页面简要介绍了 Security Health Analytics 自定义模块。 如需了解内置模块，请参阅 Security Health Analytics 内置检测器。

借助自定义模块，您可以通过创建自定义检测器来扩展 Security Health Analytics 的检测功能，该检测器可扫描您使用定义的规则指定的 Google Cloud资源和政策，以检查是否存在漏洞、配置错误或违规情况。

自定义模块的配置或定义（无论是在Google Cloud 控制台中创建自定义模块还是自行对其进行编码）决定了检测器检查的资源、检测器评估的属性，以及检测器在检测到漏洞或配置错误时返回的信息。

您可以为 Security Command Center 支持的任何资源或资产创建自定义模块。

如果您自行对自定义模块定义进行编码，则可以使用 YAML 和通用表达式语言 (CEL) 表达式。如果您使用Google Cloud 控制台创建自定义模块，则系统会为您完成大部分编码工作，但您需要对 CEL 表达式进行编码。

如需查看 YAML 文件中的自定义模块定义示例，请参阅自定义模块定义示例。

在实时扫描和批量扫描中，自定义模块会与 Security Health Analytics 的内置检测器一起运行。在实时模式下，每当资产的配置更改时，系统就会触发扫描。系统每天会对已注册的组织或项目的所有检测器运行一次批量模式扫描。

在扫描期间，每个自定义检测器都会应用于启用了它的每个组织、文件夹或项目中所有匹配的资产。

来自自定义检测器的发现结果会写入 Security Command Center。

详情请参阅以下内容：

比较内置检测器和自定义模块

您可以使用内置 Security Health Analytics 检测器无法检测的自定义模块进行检测；但是，内置检测器支持自定义模块不支持的特定 Security Command Center 功能。

功能支持

攻击路径模拟不支持 Security Health Analytics 自定义模块，因此自定义模块生成的发现结果不会获得攻击风险得分或攻击路径。

比较检测逻辑

作为说明可以使用自定义模块执行的某些操作的示例，您可以将内置检测器 PUBLIC_SQL_INSTANCE 检查的内容与可以使用自定义模块执行的操作进行比较。

内置检测器 PUBLIC_SQL_INSTANCE 会检查 Cloud SQL 实例的 authorizedNetworks 属性是否设置为 0.0.0.0/0。 如果是，则检测器会生成发现结果，表明 Cloud SQL 实例对公众开放，因为它接受来自所有 IP 地址的连接。

借助自定义模块，您可以实现更复杂的检测逻辑，以检查 Cloud SQL 实例是否存在以下各项：

  • 具有特定前缀的 IP 地址（使用通配符）。
  • state 属性的值，可用于在值设置为 MAINTENANCE 时忽略实例，或在值为其他值时触发发现结果。
  • region 属性的值，可用于仅对在特定区域具有公共 IP 地址的实例触发发现结果。

所需的 IAM 角色和权限

IAM 角色决定了您可以使用 Security Health Analytics 自定义模块执行的操作。

下表列出了所需的 Security Health Analytics 自定义模块权限以及可提供这些权限的预定义 IAM 角色。

您可以使用 Google Cloud 控制台或 Security Command Center API 在组织、文件夹或项目级应用这些角色。

所需权限 角色
securitycentermanagement.securityHealthAnalyticsCustomModules.create
securitycentermanagement.securityHealthAnalyticsCustomModules.update
securitycentermanagement.securityHealthAnalyticsCustomModules.delete
securitycentermanagement.securityHealthAnalyticsCustomModules.list
securitycentermanagement.securityHealthAnalyticsCustomModules.get
securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list
securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get
securitycentermanagement.securityHealthAnalyticsCustomModules.simulate
securitycentermanagement.securityHealthAnalyticsCustomModules.test 		roles/securitycentermanagement.shaCustomModulesEditor
roles/securitycenter.settingsEditor
roles/securitycenter.admin
securitycentermanagement.securityHealthAnalyticsCustomModules.list
securitycentermanagement.securityHealthAnalyticsCustomModules.get
securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list
securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get
securitycentermanagement.securityHealthAnalyticsCustomModules.simulate
securitycentermanagement.securityHealthAnalyticsCustomModules.test 		roles/securitycentermanagement.shaCustomModulesViewer
roles/securitycenter.settingsViewer
roles/securitycenter.adminViewer
roles/securitycenter.admin

如需详细了解 IAM 权限和角色以及如何授予这些权限和角色，请参阅使用 Google Cloud 控制台授予 IAM 角色。

自定义模块配额

Security Health Analytics 自定义模块受配额限制的约束。

创建自定义模块的默认配额限制为 100，但如有必要，您可以申请增加配额。

对自定义模块方法的 API 调用也受配额限制的约束。下表展示了自定义模块 API 调用的默认配额限制。

API 调用类型 限制
CustomModules 读取请求（获取、列出） 每个组织每分钟 1,000 次 API 调用
CustomModules 写入请求（创建、更新、删除） 每个组织每分钟 60 次 API 调用
CustomModules 测试请求 每个组织每分钟 12 次 API 调用

如需增加配额，请在 Google Cloud 控制台的配额页面上提交申请。

如需详细了解 Security Command Center 配额，请参阅配额和限制。

支持的资源类型

Access Context Manager
accesscontextmanager.googleapis.com/AccessLevel
accesscontextmanager.googleapis.com/AccessPolicy
accesscontextmanager.googleapis.com/ServicePerimeter
Address
compute.googleapis.com/Address
Alert Policy
monitoring.googleapis.com/AlertPolicy
AlloyDB for PostgreSQL
alloydb.googleapis.com/Backup
alloydb.googleapis.com/Cluster
alloydb.googleapis.com/Instance
Api Keys
apikeys.googleapis.com/Key
Artifact Registry Repository
artifactregistry.googleapis.com/Repository
Autoscaler
compute.googleapis.com/Autoscaler
Backend Bucket
compute.googleapis.com/BackendBucket
Backend Service
compute.googleapis.com/BackendService
BigQuery Data Transfer Service
bigquerydatatransfer.googleapis.com/TransferConfig
BigQuery Model
bigquery.googleapis.com/Model
BigQuery Table
bigquery.googleapis.com/Table
Bucket
storage.googleapis.com/Bucket
Cloud Billing Project Billing Info
cloudbilling.googleapis.com/ProjectBillingInfo
Cloud Data Fusion
datafusion.googleapis.com/Instance
Cloud Function
cloudfunctions.googleapis.com/CloudFunction
Cloud Run
run.googleapis.com/DomainMapping
run.googleapis.com/Execution
run.googleapis.com/Job
run.googleapis.com/Revision
run.googleapis.com/Service
Cluster
container.googleapis.com/Cluster
Cluster Role
rbac.authorization.k8s.io/ClusterRole
Cluster Role Binding
rbac.authorization.k8s.io/ClusterRoleBinding
Commitment
compute.googleapis.com/Commitment
Composer Environment
composer.googleapis.com/Environment
Compute Project
compute.googleapis.com/Project
compute.googleapis.com/SecurityPolicy
CryptoKey
cloudkms.googleapis.com/CryptoKey
CryptoKey Version
cloudkms.googleapis.com/CryptoKeyVersion
Dataflow Job
dataflow.googleapis.com/Job
Dataproc Autoscaling Policy
dataproc.googleapis.com/AutoscalingPolicy
Dataproc Batch
dataproc.googleapis.com/Batch
Dataproc Cluster
dataproc.googleapis.com/Cluster
Dataproc Job
dataproc.googleapis.com/Job
Dataset
bigquery.googleapis.com/Dataset
Datastream Connection Profile
datastream.googleapis.com/ConnectionProfile
Datastream Private Connection
datastream.googleapis.com/PrivateConnection
Datastream Stream
datastream.googleapis.com/Stream
Dialogflow CX
dialogflow.googleapis.com/Agent
Disk
compute.googleapis.com/Disk
DLP Deidentify Template
dlp.googleapis.com/DeidentifyTemplate
DLP Inspect Template
dlp.googleapis.com/InspectTemplate
DLP Job
dlp.googleapis.com/DlpJob
DLP Job Trigger
dlp.googleapis.com/JobTrigger
DLP Stored Info Type
dlp.googleapis.com/StoredInfoType
DNS Policy
dns.googleapis.com/Policy
File Instance
file.googleapis.com/Instance
Firewall
compute.googleapis.com/Firewall
Firewall Policy
compute.googleapis.com/FirewallPolicy
Folder
cloudresourcemanager.googleapis.com/Folder
Forwarding Rule
compute.googleapis.com/ForwardingRule
Global Forwarding Rule
compute.googleapis.com/GlobalForwardingRule
Health Check
compute.googleapis.com/HealthCheck
Hub
gkehub.googleapis.com/Feature
gkehub.googleapis.com/Membership
IAM Role
iam.googleapis.com/Role
Image
compute.googleapis.com/Image
Instance
compute.googleapis.com/Instance
Instance Group
compute.googleapis.com/InstanceGroup
Instance Group Manager
compute.googleapis.com/InstanceGroupManagers
Instance Template
compute.googleapis.com/InstanceTemplate
Interconnect Attachment
compute.googleapis.com/InterconnectAttachment
Keyring
cloudkms.googleapis.com/KeyRing
KMS Import Job
cloudkms.googleapis.com/ImportJob
Kubernetes CronJob
k8s.io/CronJob
Kubernetes DaemonSet
k8s.io/DaemonSet
Kubernetes Deployment
k8s.io/Deployment
Kubernetes Ingress
k8s.io/Ingress
Kubernetes NetworkPolicy
k8s.io/NetworkPolicy
Kubernetes ReplicaSet
k8s.io/ReplicaSet
Kubernetes Service
k8s.io/Service
Kubernetes StatefulSet
k8s.io/StatefulSet
Log Bucket
logging.googleapis.com/LogBucket
Log Metric
logging.googleapis.com/LogMetric
Log Sink
logging.googleapis.com/LogSink
Managed Zone
dns.googleapis.com/ManagedZone
Machine Image
compute.googleapis.com/MachineImage
Monitoring Notification Channel
monitoring.googleapis.com/NotificationChannel
Namespace
k8s.io/Namespace
NetApp Snapshot
netapp.googleapis.com/Snapshot
NetApp Volume
netapp.googleapis.com/Volume
Network
compute.googleapis.com/Network
Network Endpoint Group
compute.googleapis.com/NetworkEndpointGroup
Node
k8s.io/Node
Node Group
compute.googleapis.com/NodeGroup
Node Template
compute.googleapis.com/NodeTemplate
Nodepool
container.googleapis.com/NodePool
Organization
cloudresourcemanager.googleapis.com/Organization
Organization Policy Service v2
orgpolicy.googleapis.com/CustomConstraint
orgpolicy.googleapis.com/Policy
Packet Mirroring
compute.googleapis.com/PacketMirroring
Pod
k8s.io/Pod
Private CA Certificate
privateca.googleapis.com/Certificate
Private CA Certificate Revocation List
privateca.googleapis.com/CertificateRevocationList
Project
cloudresourcemanager.googleapis.com/Project
Pubsub Snapshot
pubsub.googleapis.com/Snapshot
Pubsub Subscription
pubsub.googleapis.com/Subscription
Pubsub Topic
pubsub.googleapis.com/Topic
Redis Cluster
redis.googleapis.com/Cluster
Redis Instance
redis.googleapis.com/Instance
Region Backend Service
compute.googleapis.com/RegionBackendService
Region Disk
compute.googleapis.com/RegionDisk
Reservation
compute.googleapis.com/Reservation
Resource Policy
compute.googleapis.com/ResourcePolicy
Route
compute.googleapis.com/Route
Router
compute.googleapis.com/Router
Role
rbac.authorization.k8s.io/Role
Role Binding
rbac.authorization.k8s.io/RoleBinding
Secret Manager
secretmanager.googleapis.com/Secret
Secret Version
secretmanager.googleapis.com/SecretVersion
Service Account Key
iam.googleapis.com/ServiceAccountKey
ServiceUsage Service
serviceusage.googleapis.com/Service
Snapshot
compute.googleapis.com/Snapshot
Spanner Backup
spanner.googleapis.com/Backup
Spanner Database
spanner.googleapis.com/Database
Spanner Instance
spanner.googleapis.com/Instance
SQL Backup Run
sqladmin.googleapis.com/BackupRun
SQL Instance
sqladmin.googleapis.com/Instance
SSL Certificate
compute.googleapis.com/SslCertificate
SSL Policy
compute.googleapis.com/SslPolicy
Subnetwork
compute.googleapis.com/Subnetwork
Tag Binding
cloudresourcemanager.googleapis.com/TagBinding
Target HTTP Proxy
compute.googleapis.com/TargetHttpProxy
Target HTTPS Proxy
compute.googleapis.com/TargetHttpsProxy
Target Instance
compute.googleapis.com/TargetInstance
Target Pool
compute.googleapis.com/TargetPool
Target SSL Proxy
compute.googleapis.com/TargetSslProxy
Target VPN Gateway
compute.googleapis.com/TargetVpnGateway
URL Map
compute.googleapis.com/UrlMap
Vertex AI
aiplatform.googleapis.com/BatchPredictionJob
aiplatform.googleapis.com/CustomJob
aiplatform.googleapis.com/Dataset
aiplatform.googleapis.com/Endpoint
aiplatform.googleapis.com/Featurestore
aiplatform.googleapis.com/HyperparameterTuningJob
aiplatform.googleapis.com/Index
aiplatform.googleapis.com/MetadataStore
aiplatform.googleapis.com/Model
aiplatform.googleapis.com/SpecialistPool
aiplatform.googleapis.com/Tensorboard
aiplatform.googleapis.com/TrainingPipeline
aiplatform.googleapis.com/NotebookRuntimeTemplate
Vertex AI Workbench
notebooks.googleapis.com/Instance
VMware Engine
vmwareengine.googleapis.com/Cluster
vmwareengine.googleapis.com/ExternalAccessRule
vmwareengine.googleapis.com/ExternalAddress
vmwareengine.googleapis.com/VmwareEngineNetwork
vmwareengine.googleapis.com/NetworkPeering
vmwareengine.googleapis.com/NetworkPolicy
vmwareengine.googleapis.com/PrivateCloud
vmwareengine.googleapis.com/PrivateConnection
VPC Connector
vpcaccess.googleapis.com/Connector
VPN Gateway
compute.googleapis.com/VpnGateway
VPN Tunnel
compute.googleapis.com/VpnTunnel
Workstations
workstations.googleapis.com/Workstation
workstations.googleapis.com/WorkstationConfig

后续步骤