Dampak: Pencadangan dan DR Google Cloud mengurangi masa berlaku cadangan
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Event Threat Detection memeriksa log audit untuk mendeteksi apakah tanggal habis masa berlaku
untuk pencadangan di appliance Backup and DR Service telah dikurangi.
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Impact: Google Cloud Backup and DR reduced backup expiration
seperti yang dijelaskan dalam Meninjau temuan. Panel detail untuk temuan akan terbuka ke tab Ringkasan.
Di tab Summary, tinjau informasi di bagian berikut:
Apa yang terdeteksi, terutama kolom berikut:
Deskripsi: informasi tentang deteksi
Subjek utama: pengguna atau akun layanan yang telah berhasil
mengeksekusi tindakan
Resource yang terpengaruh
Nama tampilan resource: project tempat masa berlaku pencadangan dikurangi.
Link terkait, terutama kolom berikut:
Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK.
Logging URI: link untuk membuka Logs Explorer.
Langkah 2: Meneliti metode serangan dan respons
Hubungi pemilik akun layanan di kolom Principal subject.
Konfirmasi apakah pemilik yang sah melakukan tindakan tersebut.
Langkah 3: Terapkan respons Anda
Rencana respons berikut mungkin sesuai untuk temuan ini, tetapi juga dapat memengaruhi operasi.
Evaluasi dengan cermat informasi yang Anda kumpulkan dalam penyelidikan untuk menentukan cara terbaik dalam menyelesaikan temuan.
Di project tempat tindakan dilakukan, buka konsol pengelolaan.
Di tab Pengelola Aplikasi, temukan aplikasi yang terpengaruh yang masa berlaku pencadangannya dikurangi dan verifikasi bahwa masa berlaku tersebut memang diinginkan oleh pemiliknya.
Untuk memulai pencadangan baru aplikasi, pilih
Kelola Konfigurasi Pencadangan untuk membuat pencadangan on-demand atau
menjadwalkan pencadangan baru.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nEvent Threat Detection examines audit logs to detect whether the expiration date\nfor a backup on a Backup and DR Service appliance has been reduced.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Impact: Google Cloud Backup and DR reduced backup expiration` finding, as detailed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). The details panel for the finding opens to the **Summary** tab.\n2. On the **Summary** tab, review the information in the following sections:\n - **What was detected** , especially the following fields:\n - **Description**: information about the detection\n - **Principal subject**: a user or service account that has successfully executed an action\n - **Affected resource**\n - **Resource display name**: the project in which the backup's expiration was reduced.\n - **Related links** , especially the following fields:\n - **MITRE ATTACK method**: link to the MITRE ATT\\&CK documentation.\n - **Logging URI** : link to open the **Logs Explorer**.\n\nStep 2: Research attack and response methods\n\nContact the owner of the service account in the **Principal subject** field.\nConfirm whether the legitimate owner conducted the action.\n\nStep 3: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n1. In the project where the action was taken, navigate to the management console.\n2. In the **App Manager** tab, find the affected application for which backup expiration was reduced and verify that the expiration was intended by the principal.\n3. To initiate a new backup of the application, select **Manage Backup Configurations** to create an on-demand backup or to schedule a new backup.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
