Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Klik instance VM yang cocok dengan nama dan zona di vmName. Tinjau detail instance, termasuk setelan jaringan dan akses.
Di panel navigasi, klik VPC Network, lalu klik Firewall.
Hapus atau nonaktifkan aturan firewall yang terlalu permisif di port 22.
Langkah 3: Periksa log
Di konsol Google Cloud , buka Logs Explorer dengan mengklik
link di Cloud Logging URI.
Di halaman yang dimuat, temukan VPC Flow Logs yang terkait dengan alamat IP yang tercantum di baris Email utama di tab Ringkasan detail temuan menggunakan filter berikut:
Tinjau temuan terkait dengan mengklik link di Temuan terkait pada baris Temuan terkait di tab Ringkasan detail temuan.
Temuan terkait adalah jenis temuan yang sama serta instance dan jaringan yang sama.
Untuk mengembangkan rencana respons, gabungkan hasil penyelidikan Anda dengan penelitian MITRE.
Langkah 5: Terapkan respons Anda
Rencana respons berikut mungkin sesuai untuk temuan ini, tetapi juga dapat memengaruhi operasi.
Evaluasi dengan cermat informasi yang Anda kumpulkan dalam penyelidikan untuk menentukan cara terbaik dalam menyelesaikan temuan.
Hubungi pemilik project yang mengalami upaya brute force yang berhasil.
Selidiki instance yang berpotensi disusupi dan hapus malware yang ditemukan. Untuk membantu deteksi dan penghapusan, gunakan solusi deteksi dan respons endpoint.
Pertimbangkan untuk menonaktifkan akses SSH ke VM. Untuk
informasi tentang cara menonaktifkan kunci SSH, lihat Membatasi kunci SSH dari
VM.
Langkah ini dapat mengganggu akses yang sah ke VM, jadi pertimbangkan kebutuhan organisasi Anda sebelum melanjutkan.
Blokir alamat IP berbahaya dengan memperbarui aturan firewall atau menggunakan Google Cloud Armor. Anda dapat mengaktifkan
Cloud Armor di halaman Layanan Terintegrasi
Security Command Center. Bergantung pada jumlah informasi, biaya Cloud Armor bisa
menjadi signifikan. Lihat panduan harga Cloud Armor untuk mengetahui informasi selengkapnya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-10 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nDetection of successful brute force of SSH on a host.\n\n[Event Threat Detection](/security-command-center/docs/concepts-event-threat-detection-overview) is the source of\nthis finding.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open a `Brute Force: SSH` finding, as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. On the **Summary** tab of the finding details panel, review the\n information in the following sections:\n\n - **What was detected, especially the following fields:**\n\n - **Caller IP**: the IP address that launched the attack.\n - **User name**: the account that logged in.\n - **Affected resource**\n\n - **Related links**, especially the following fields:\n\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n3. Click the **JSON** tab.\n\n4. In the JSON, note the following fields.\n\n - `sourceProperties`:\n - `evidence`:\n - `sourceLogId`: the project ID and timestamp to identify the log entry\n - `projectId`: the project that contains the finding\n - `properties`:\n - `attempts`:\n - `Attempts`: the number of login attempts\n - `username`: the account that logged in\n - `vmName`: the name of the virtual machine\n - `authResult`: the SSH authentication result\n\nStep 2: Review permissions and settings\n\n1. In the Google Cloud console, go to the **Dashboard**.\n\n \u003cbr /\u003e\n\n [Go to the Dashboard](https://console.cloud.google.com/home)\n\n \u003cbr /\u003e\n\n2. Select the project that is specified in\n `projectId`.\n\n3. Navigate to the **Resources** card and click **Compute Engine**.\n\n4. Click the VM instance that matches the name and zone in `vmName`. Review\n instance details, including network and access settings.\n\n5. In the navigation pane, click **VPC Network** , then click **Firewall**.\n Remove or disable overly permissive firewall rules on port 22.\n\nStep 3: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer** by clicking the link in **Cloud Logging URI**.\n2. On the page that loads, find VPC Flow Logs related to the IP address that is listed on the **Principal email** row in the **Summary** tab of the finding details by using the following filter:\n - `logName=\"projects/`\u003cvar class=\"edit\" translate=\"no\"\u003eprojectId\u003c/var\u003e`/logs/syslog\"`\n - `labels.\"compute.googleapis.com/resource_name\"=\"`\u003cvar class=\"edit\" translate=\"no\"\u003evmName\u003c/var\u003e`\"`\n\nStep 4: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Valid Accounts: Local Accounts](https://attack.mitre.org/techniques/T1078/003/).\n2. Review related findings by clicking the link on the **Related findings** on the **Related findings** row in the **Summary** tab of the finding details. Related findings are the same finding type and the same instance and network.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 5: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Contact the owner of the project with the successful brute force attempt.\n- Investigate the potentially compromised instance and remove any discovered malware. To assist with detection and removal, use an endpoint detection and response solution.\n- Consider disabling SSH access to the VM. For information about disabling SSH keys, see [Restrict SSH keys from\n VMs](/compute/docs/connect/restrict-ssh-keys). This step could interrupt authorized access to the VM, so consider the needs of your organization before you proceed.\n- Only use SSH authentication with [authorized\n keys](/compute/docs/instances/ssh).\n- Block the malicious IP addresses by [updating firewall\n rules](/vpc/docs/using-firewalls) or by using Google Cloud Armor. You can enable Cloud Armor on the Security Command Center [Integrated\n Services](https://console.cloud.google.com/security/command-center/config/integrated-services) page. Depending on the quantity of information, Cloud Armor costs can be significant. See the [Cloud Armor pricing guide](/armor/pricing) for more information.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
