이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
Google Workspace 로그를 Cloud Logging과 공유하면 Event Threat Detection에서 여러 Google Workspace 위협에 대한 발견 항목을 생성합니다. Google Workspace 로그는 조직 수준에 있으므로 조직 수준에서 Security Command Center를 활성화하는 경우에만 Event Threat Detection이 이러한 로그를 검사할 수 있습니다.
Event Threat Detection은 로그 이벤트를 보강하고 발견 항목을 Security Command Center에 기록합니다. 다음 표에는 Google Workspace 위협 발견 항목 유형, 이 발견 항목과 관련된 MITRE ATT&CK 프레임워크 항목, 이 발견 항목을 트리거하는 이벤트에 대한 세부정보가 설명되어 있습니다. 특정 필터를 사용하여 로그를 확인하고 수집한 모든 정보를 결합하여 이 결과에 대응할 수도 있습니다.
프로젝트 수준에서 Security Command Center를 활성화하면 이 발견 항목을 사용할 수 없습니다.
설명
작업
관리자 계정의 SSO 설정이 변경되었습니다.
조직의 SSO 설정이 변경되었습니다. 의도적으로 구성원이 수행한 변경인지 또는 조직에서 새로운 액세스 권한을 도입하기 위해 공격자가 구현했는지 확인합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\n\nIf you share your Google Workspace logs with Cloud Logging,\nEvent Threat Detection generates findings for several Google Workspace\nthreats. Because Google Workspace logs are at the organization level,\nEvent Threat Detection can only scan them if you activate Security Command Center\nat the organization level.\n\n\nEvent Threat Detection enriches log events and writes findings to\nSecurity Command Center. The following table describes a Google Workspace\nthreat finding type, the [MITRE ATT\\&CK framework](https://attack.mitre.org/)\nentry related to this finding, and details about the\nevents that trigger this finding. You can also check logs using specific filters,\nand combine all of the information that you gather to respond to this finding.\n\n\u003cbr /\u003e\n\nThis finding isn't available if you activate Security Command Center at the project\nlevel.\n\n| Description | Actions ||\n|------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| The SSO settings for the admin account were changed. | SSO settings for your organization were changed. Verify whether the change was done intentionally by a member or if it was implemented by an adversary to introduce new access to your organization. | **Check logs using the following filters:** `protopayload.resource.labels.service=\"admin.googleapis.com\"` `protopayload.metadata.event.parameter.value=`\u003cvar class=\"edit\" translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e `logName=\"organizations/`\u003cvar class=\"edit\" translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e`/logs/cloudaudit.googleapis.com%2Factivity` Replace the following: - `DOMAIN_NAME`: the `domainName` listed in the finding - `ORGANIZATION_ID`: your organization ID \u003cbr /\u003e |\n| The SSO settings for the admin account were changed. | SSO settings for your organization were changed. Verify whether the change was done intentionally by a member or if it was implemented by an adversary to introduce new access to your organization. | **Research events that trigger this finding:** - **MITRE:** \u003chttps://attack.mitre.org/techniques/T1098/\u003e - **Workspace event details:** \u003chttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#CHANGE_SSO_SETTINGS\u003e |\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
