Dampak: Cadangan Layanan Pencadangan dan DR Google Cloud yang Dihapus
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Event Threat Detection memeriksa log audit untuk mendeteksi apakah cadangan yang disimpan di vault cadangan telah dihapus.
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Impact: Deleted Google Cloud Backup and DR Backup
seperti yang dijelaskan dalam Meninjau temuan. Panel detail untuk temuan akan terbuka ke tab Ringkasan.
Di tab Summary, tinjau informasi di bagian berikut:
Apa yang terdeteksi, terutama kolom berikut:
Deskripsi: informasi tentang deteksi.
Subjek utama: pengguna atau akun layanan yang telah berhasil
mengeksekusi tindakan.
Resource yang terpengaruh
Nama tampilan resource: project tempat frekuensi pencadangan dikurangi.
Link terkait, terutama kolom berikut:
Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK.
Logging URI: link untuk membuka Logs Explorer.
Langkah 2: Meneliti metode serangan dan respons
Hubungi pemilik akun layanan di kolom Principal subject dan
konfirmasi apakah mereka melakukan tindakan tersebut.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nEvent Threat Detection examines audit logs to detect whether a backup stored in a backup vault has been deleted.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Impact: Deleted Google Cloud Backup and DR Backup` finding, as detailed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). The details panel for the finding opens to the **Summary** tab.\n2. On the **Summary** tab, review the information in the following sections:\n - **What was detected** , especially the following fields:\n - **Description**: information about the detection.\n - **Principal subject**: a user or service account that has successfully executed an action.\n - **Affected resource**\n - **Resource display name**: the project in which the backup frequency was reduced.\n - **Related links** , especially the following fields:\n - **MITRE ATTACK method**: link to the MITRE ATT\\&CK documentation.\n - **Logging URI** : link to open the **Logs Explorer**.\n\nStep 2: Research attack and response methods\n\nContact the owner of the service account in the **Principal subject** field and\nconfirm whether they conducted the action.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
