Using Event Threat Detection

Review Event Threat Detection findings in the Security Command Center dashboard and see examples of Event Threat Detection findings.

Event Threat Detection is a built-in service for the Security Command Center Premium tier that monitors your organization's Cloud Logging stream and detects threats in near-real time. To learn more, see Event Threat Detection overview.

The following video shows the steps to set up Event Threat Detection and provides information about how to use the dashboard. Learn more about viewing and managing Event Threat Detection findings in Reviewing findings on this page.

Reviewing findings

To view Event Threat Detection findings, it must be enabled in Security Command Center Services settings. After you enable Event Threat Detection and turn on logs for your organization, folders, and projects, Event Threat Detection generates findings.

You can view Event Threat Detection findings in Security Command Center. If you configured Continuous Exports to write logs, you can also view findings in Cloud Logging. To generate a finding and verify your configuration, you can intentionally trigger a detector and test Event Threat Detection.

Event Threat Detection activation occurs within seconds. Detection latencies are generally less than 15 minutes from the time a log is written to when a finding is available in Security Command Center. For more information on latency, see Security Command Center latency overview.

Reviewing findings in Security Command Center

To review Event Threat Detection findings in Security Command Center:

  1. Go to the Security Command Center Findings tab in the Google Cloud Console.
    Go to the Findings tab
  2. Next to View by, click Source Type.
  3. In the Source type list, select Event Threat Detection.
  4. To view details about a specific finding, click the finding name under category. The finding details panel expands to display information, including the following:
    • What the event was
    • When the event occurred
    • The source of the finding data
    • The detection priority, for example High
    • The actions taken, like adding an Identity and Access Management (IAM) role to a Gmail user
    • The user who took the action, listed next to properties_principalEmail
  5. To display all findings that were caused by the same user's actions:
    1. On the finding detail panel, copy the email address next to properties_principalEmail.
    2. Close the finding detail panel.
    3. In the Findings tab Filter box, enter sourceProperties.properties_principalEmail:USER_EMAIL, where USER_EMAIL is the email address you copied previously.

Security Command Center displays all findings that are associated with actions taken by the user you specified.

Viewing findings in Cloud Logging

To view Event Threat Detection findings in Cloud Logging, do the following:

  1. Go to Logs Explorer in the Cloud Console.

    Go to Logs Explorer

  2. In the Project selector at the top of the page, select the project where you are storing your Event Threat Detection logs.

  3. Click the Query builder tab.

  4. In the Resource drop-down list, select Threat Detector.

    • To view findings from all detectors, select all detector_name.
    • To view findings from a specific detector, select its name.
  5. Click Add. The query appears in the query builder text box.

  6. Alternatively, enter the following query in the text box:

    resource.type="threat_detector"
    

  7. Click Run Query. The Query results table is updated with the logs you selected.

  8. To view a log, click a table row, and then click Expand nested fields.

You can create advanced log queries to specify a set of log entries from any number of logs.

Finding categories

Example Event Threat Detection findings include the following:

Monitoring & Logging Description
Data exfiltration

Event Threat Detection detects data exfiltration from BigQuery by examining audit logs for two scenarios:

  • A resource is saved outside of your organization, or a copy operation is attempted that is blocked by VPC Service Controls.
  • An attempt is made to access BigQuery resources that are protected by VPC Service Controls.
Brute force SSH Event Threat Detection detects brute force of password authentication SSH by examining syslog logs for repeated failures followed by a success.
Cryptomining Event Threat Detection detects coin mining malware by examining VPC flow logs and Cloud DNS logs for connections to known bad domains for mining pools.
IAM abuse

Anomalous IAM grants: Event Threat Detection detects the addition of IAM grants that might be considered anomalous, like:

  • Adding a gmail.com user to a policy with the project editor role.
  • Inviting a gmail.com user as a project owner from the Google Cloud Console.
  • Service account granting sensitive permissions.
  • Custom role granted sensitive permissions.
  • Service account added from outside your organization.
Malware Event Threat Detection detects malware by examining VPC flow logs and Cloud DNS logs for connections to known command and control domains and IPs.
Phishing Event Threat Detection detects phishing by examining VPC flow logs and Cloud DNS logs for connections to known phishing domains and IPs.
Anomalous IAM Behavior
Preview
Event Threat Detection detects anomalous IAM behavior by examining Cloud Audit Logs for accesses from anomalous IP addresses and anomalous user agents.
Service account self-investigation
Preview
Event Threat Detection detects when a service account credential is used to investigate the roles and permissions associated with that same service account.

Example finding formats

This section includes the JSON output formats for individual Event Threat Detection findings as they appear when you create exports from the Security Command Center dashboard or run list methods in the Security Command Center API.

The output examples contain the fields most common to all findings. However, all fields may not appear in every finding. The actual output you see depends on a resource's configuration and the type and state of findings.

Brute Force: SSH

{
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "state": "ACTIVE",
      "category": "Brute Force: SSH",
      "sourceProperties": {
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "timestamp": {
                "nanos": 0.0,
                "seconds": "65"
              },
              "insertId": "INSERT_ID",
              "resourceContainer": "projects/PROJECT_ID"
            }
          }
        ],
        "properties": {
          "projectId": "PROJECT_ID",
          "zone": "us-west1-a",
          "instanceId": "INSTANCE_ID",
          "attempts": [
            {
              "sourceIp": "SOURCE_IP_ADDRESS",
              "username": "PROJECT_ID",
              "vmName": "INSTANCE_ID",
              "authResult": "SUCCESS"
            },
            {
              "sourceIp": "SOURCE_IP_ADDRESS",
              "username": "PROJECT_ID",
              "vmName": "INSTANCE_ID",
              "authResult": "FAIL"
            },
            {
              "sourceIp": "SOURCE_IP_ADDRESS",
              "username": "PROJECT_ID",
              "vmName": "INSTANCE_ID",
              "authResult": "FAIL"
            }
          ]
        },
        "detectionPriority": "HIGH",
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1078/003/"
          }
        },
        "detectionCategory": {
          "technique": "brute_force",
          "indicator": "flow_log",
          "ruleName": "ssh_brute_force"
        },
        "affectedResources": [
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ]
      },
      "severity": "HIGH",
      "eventTime": "1970-01-01T00:00:00Z",
      "createTime": "1970-01-01T00:00:00Z"
    }
 }
    

Discovery: Service Account Self-Investigation


{
  "finding": {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "state": "ACTIVE",
    "category": "Discovery: Service Account Self-Investigation",
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "PROJECT_NUMBER",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "technique": "discovery",
        "indicator": "audit_log",
        "ruleName": "iam_anomalous_behavior",
        "subRuleName": "service_account_gets_own_iam_policy"
      },
      "detectionPriority": "LOW",
      "affectedResources": [{
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }],
      "evidence": [{
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "1619200104",
            "nanos": 9.08E8
          },
          "insertId": "INSERT_ID"
        }
      }],
      "properties": {
        "serviceAccountGetsOwnIamPolicy": {
          "principalEmail": "USER_EMAIL@PROJECT_ID.iam.gserviceaccount.com",
          "projectId": "PROJECT_ID",
          "callerIp": "IP_ADDRESS",
          "callerUserAgent": "CALLER_USER_AGENT",
          "rawUserAgent": "RAW_USER_AGENT"
        }
      },
      "contextUris": {
        "mitreUri": {
          "displayName": "Permission Groups Discovery: Cloud Groups",
          "url": "https://attack.mitre.org/techniques/T1069/003/"
        },
        "cloudLoggingQueryUri": [{
          "displayName": "Cloud Logging Query Link",
          "url": "LOGGING_LINK"
        }]
      }
    },
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2021-04-23T17:48:24.908Z",
    "createTime": "2021-04-23T17:48:26.922Z",
    "propertyDataTypes": {
      "sourceId": {
        "structValue": {
          "fields": {
            "projectNumber": {
              "primitiveDataType": "STRING"
            },
            "customerOrganizationNumber": {
              "primitiveDataType": "STRING"
            }
          }
        }
      },
      "evidence": {
        "listValues": {
          "propertyDataTypes": [{
            "structValue": {
              "fields": {
                "sourceLogId": {
                  "structValue": {
                    "fields": {
                      "projectId": {
                        "primitiveDataType": "STRING"
                      },
                      "resourceContainer": {
                        "primitiveDataType": "STRING"
                      },
                      "timestamp": {
                        "dataType": "TIMESTAMP",
                        "structValue": {
                          "fields": {
                            "seconds": {
                              "primitiveDataType": "STRING"
                            },
                            "nanos": {
                              "primitiveDataType": "NUMBER"
                            }
                          }
                        }
                      },
                      "insertId": {
                        "primitiveDataType": "STRING"
                      }
                    }
                  }
                }
              }
            }
          }]
        }
      },
      "detectionPriority": {
        "primitiveDataType": "STRING"
      },
      "contextUris": {
        "structValue": {
          "fields": {
            "mitreUri": {
              "dataType": "HYPERLINK",
              "structValue": {
                "fields": {
                  "display_name": {
                    "primitiveDataType": "STRING"
                  },
                  "url": {
                    "primitiveDataType": "STRING"
                  }
                }
              }
            },
            "cloudLoggingQueryUri": {
              "listValues": {
                "propertyDataTypes": [{
                  "dataType": "HYPERLINK",
                  "structValue": {
                    "fields": {
                      "display_name": {
                        "primitiveDataType": "STRING"
                      },
                      "url": {
                        "primitiveDataType": "STRING"
                      }
                    }
                  }
                }]
              }
            }
          }
        }
      },
      "detectionCategory": {
        "structValue": {
          "fields": {
            "technique": {
              "primitiveDataType": "STRING"
            },
            "indicator": {
              "primitiveDataType": "STRING"
            },
            "ruleName": {
              "primitiveDataType": "STRING"
            },
            "subRuleName": {
              "primitiveDataType": "STRING"
            }
          }
        }
      },
      "affectedResources": {
        "listValues": {
          "propertyDataTypes": [{
            "structValue": {
              "fields": {
                "gcpResourceName": {
                  "primitiveDataType": "STRING"
                }
              }
            }
          }]
        }
      },
      "properties": {
        "structValue": {
          "fields": {
            "serviceAccountGetsOwnIamPolicy": {
              "structValue": {
                "fields": {
                  "principalEmail": {
                    "primitiveDataType": "STRING"
                  },
                  "projectId": {
                    "primitiveDataType": "STRING"
                  },
                  "callerIp": {
                    "primitiveDataType": "STRING"
                  },
                  "callerUserAgent": {
                    "primitiveDataType": "STRING"
                  },
                  "rawUserAgent": {
                    "primitiveDataType": "STRING"
                  }
                }
              }
            }
          }
        }
      }
    },
    "severity": "LOW",
    "workflowState": "NEW",
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "projectDisplayName": "PROJECT_ID",
    "parentName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parentDisplayName": "ORGANIZATION_NAME",
    "type": "google.cloud.resourcemanager.Project"
  }
}

    

Exfiltration: BigQuery Data Exfiltration

{
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resource_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "state": "ACTIVE",
      "category": "Exfiltration: BigQuery Data Exfiltration",
      "sourceProperties": {
        "affectedResources": [
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          },
          {
            "gcpResourceName": "//bigquery.googleapis.com/projects/PROJECT_ID/jobs/JOB_ID"
          }
        ],
        "detectionCategory": {
          "technique": "org_exfiltration",
          "indicator": "audit_log",
          "ruleName": "big_query_exfil",
          "subRuleName": "exfil_to_external_table"
        },
        "detectionPriority": "HIGH",
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1567/002/"
          }
        },
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "timestamp": {
                "nanos": 0.0,
                "seconds": "0"
              },
              "insertId": "INSERT_ID",
              "resourceContainer": "projects/PROJECT_ID"
            }
          }
        ],
        "properties": {
          "dataExfiltrationAttempt": {
            "jobLink": "https://console.cloud.google.com/bigquery?j=bq:US:bqtriggerjob_1234_UNUSABLE_LINK&project=SOURCE_PROJECT_ID&page=queryresults",
            "jobState": "SUCCEEDED",
            "query": "SQL_QUERY",
            "userEmail": "PROJECT_ID@PROJECT_ID.iam.gserviceaccount.com",
            "job": {
              "projectId": "SOURCE_PROJECT_ID",
              "jobId": "JOB_ID",
              "location": "US"
            },
            "sourceTables": [
              {
                "resourceUri": "https://console.cloud.google.com/bigquery?p=SOURCE_PROJECT_ID&d=DATASET_ID&t=TABLE_ID&page=table",
                "projectId": "SOURCE_PROJECT_ID",
                "datasetId": "DATASET_ID",
                "tableId": "TABLE_ID"
              }
            ],
            "destinationTables": [
              {
                "resourceUri": "https://console.cloud.google.com/bigquery?p=PROJECT_ID&d=DATASET_ID&t=TABLE_ID&page=table",
                "projectId": "DESTINATION_PROJECT_ID",
                "datasetId": "DATASET_ID",
                "tableId": "TABLE_ID"
              }
            ]
          }
        }
      },
      "severity": "HIGH",
      "eventTime": "1970-01-01T00:00:00Z",
      "createTime": "1970-01-01T00:00:00Z"
    }
 }
    

Malware: Bad Domain

{
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "state": "ACTIVE",
      "category": "Malware: Bad Domain",
      "sourceProperties": {
        "sourceId": {
          "customerOrganizationNumber": "ORGANIZATION_ID",
          "projectNumber": "PROJECT_NUMBER"
        },
        "affectedResources": [{
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
        }],
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1568/"
          },          "virustotalIndicatorQueryUri": [
            {
              "displayName": "VirusTotal Domain Link",
              "url": "https://www.virustotal.com/gui/domain/DOMAIN/detection"
            }
          ]
        },
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "timestamp": {
                "nanos": 0.0,
                "seconds": "0"
              },
              "insertId": "INSERT_ID",
              "resourceContainer": "projects/PROJECT_ID"
            }
          }
        ],
        "properties": {
          "instanceDetails": "/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID",
          "domains": [
            "DOMAIN"
          ],
          "network": {
            "location": "REGION",
            "project": "PROJECT_ID"
          },
          "dnsContexts": [
            {
              "authAnswer": true,
              "sourceIp": "IP_ADDRESS",
              "queryName": "DOMAIN",
              "queryType": "AAAA",
              "responseCode": "NOERROR",
              "responseData": [
                {
                  "domainName": "DOMAIN.",
                  "ttl": 299,
                  "responseClass": "IN",
                  "responseType": "AAAA",
                  "responseValue": "IP_ADDRESS"
                }
              ]
            }
          ]
        },
        "detectionPriority": "HIGH",
        "detectionCategory": {
          "technique": "C2",
          "indicator": "domain",
          "subRuleName": "google_intel",
          "ruleName": "bad_domain"
        }
      },
      "severity": "HIGH",
      "eventTime": "1970-01-01T00:00:00Z",
      "createTime": "1970-01-01T00:00:00Z"
    }
 }
    

Malware: Bad IP

{
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "state": "ACTIVE",
      "category": "Malware: Bad IP",
      "sourceProperties": {
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "timestamp": {
                "nanos": 0.0,
                "seconds": "0"
              },
              "insertId": "INSERT_ID",
              "resourceContainer": "projects/PROJECT_ID"
            }
          }
        ],
        "properties": {
          "ips": [
            "SOURCE_IP_ADDRESS",
            "DESTINATION_IP_ADDRESS"
          ],
          "ipConnection": {
            "srcIp": "SOURCE_IP_ADDRESS",
            "srcPort": SOURCE_PORT,
            "destIp": "DESTINATION_IP_ADDRESS",
            "destPort": DESTINATION_PORT,
            "protocol": 6
          },
          "network": {
            "project": "PROJECT_ID",
            "location": "ZONE",
            "subnetworkId": "SUBNETWORK_ID",
            "subnetworkName": "default"
          },
          "instanceDetails": "/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"
        },
        "detectionPriority": "HIGH",
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/tactics/TA0011/"
          },
          "virustotalIndicatorQueryUri": [
            {
              "displayName": "VirusTotal IP Link",
              "url": "https://www.virustotal.com/gui/ip-address/SOURCE_IP_ADDRESS/detection"
            },
            {
              "displayName": "VirusTotal IP Link",
              "url": "https://www.virustotal.com/gui/ip-address/DESTINATION_IP_ADDRESS/detection"
            }
          ]
        },
        "detectionCategory": {
          "technique": "C2",
          "indicator": "ip",
          "ruleName": "bad_ip",
          "subRuleName": "google_intel"
        },
        "affectedResources": [
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ]
      },
      "severity": "HIGH",
      "eventTime": "1970-01-01T00:00:00Z",
      "createTime": "1970-01-01T00:00:00Z"
    }
}
    

Malware: Outgoing DoS

{
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "state": "ACTIVE",
      "category": "Malware: Outgoing DoS",
      "sourceProperties": {
        "evidence": [
          {
            "sourceLogId": {
              "timestamp": {
                "nanos": 0.0,
                "seconds": "0"
              },
              "resourceContainer": "projects/PROJECT_ID"
            }
          }
        ],
        "properties": {
          "sourceInstanceDetails": "/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID",
          "ipConnection": {
            "srcIp": "SOURCE_IP_ADDRESS",
            "srcPort": SOURCE_PORT,
            "destIp": "DESTINATION_IP_ADDRESS",
            "destPort": DESTINATION_PORT,
            "protocol": 17
          }
        },
        "detectionPriority": "HIGH",
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "affectedResources": [{
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
        }],
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1498/"
          }
        },
        "detectionCategory": {
          "technique": "malware",
          "indicator": "flow_log",
          "ruleName": "outgoing_dos"
        }
      },
      "severity": "HIGH",
      "eventTime": "1970-01-01T00:00:00Z",
      "createTime": "1970-01-01T00:00:00Z"
    }
}
    

Persistence: IAM Anomalous Grant

{
  "finding": {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "state": "ACTIVE",
    "category": "Persistence: IAM Anomalous Grant",
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "PROJECT_NUMBER",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "evidence": [{
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "1611833917",
            "nanos": 8.71508E8
          },
          "insertId": "INSERT_ID"
        }
      }],
      "detectionPriority": "HIGH",
      "findingId": "FINDING_ID",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "https://attack.mitre.org/techniques/T1078/004/"
        },
        "cloudLoggingQueryUri": [{
          "displayName": "Cloud Logging Query Link",
          "url": "https://console.cloud.google.com/logs/query;query\u003dtimestamp%3D%222021-01-28T11:38:37.871508Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project\u003dPROJECT_ID"
        }],
        "relatedFindingUri": {
          "displayName": "Related Anomalous Grant Findings",
          "url": "https://console.cloud.google.com/security/command-center/findings?organizationId\u003dORGANIZATION_ID\u0026pageState\u003d(%22cscc-inventory%22:(%22f%22:%22%255B%257B_22k_22_3A_22sourceProperties.detectionCategory.ruleName_22_2C_22t_22_3A10_2C_22v_22_3A_22_5C_22iam_anomalous_grant_5C_22_22%257D_2C%257B_22k_22_3A_22_22_2C_22t_22_3A10_2C_22v_22_3A_22_5C_22%2528sourceProperties.properties.sensitiveRoleGrant.principalEmail_3A_5C_5C_5C_22PRINCIPAL_EMAIL_5C_5C_5C_22%2529_5C_22_22%257D%255D%22))"
        }
      },
      "detectionCategory": {
        "technique": "persistence",
        "indicator": "audit_log",
        "ruleName": "iam_anomalous_grant",
        "subRuleName": "external_member_invited_to_policy"
      },
      "affectedResources": [{
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }],
      "properties": {
        "sensitiveRoleGrant": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "members": ["user:USER_EMAIL"]
        }
      }
    },
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2021-01-28T11:38:41.301Z",
    "createTime": "2021-01-28T11:38:42.198Z",
    "propertyDataTypes": {
      "sourceId": {
        "structValue": {
          "fields": {
            "projectNumber": {
              "primitiveDataType": "STRING"
            },
            "customerOrganizationNumber": {
              "primitiveDataType": "STRING"
            }
          }
        }
      },
      "evidence": {
        "listValues": {
          "propertyDataTypes": [{
            "structValue": {
              "fields": {
                "sourceLogId": {
                  "structValue": {
                    "fields": {
                      "projectId": {
                        "primitiveDataType": "STRING"
                      },
                      "resourceContainer": {
                        "primitiveDataType": "STRING"
                      },
                      "timestamp": {
                        "dataType": "TIMESTAMP",
                        "structValue": {
                          "fields": {
                            "seconds": {
                              "primitiveDataType": "STRING"
                            },
                            "nanos": {
                              "primitiveDataType": "NUMBER"
                            }
                          }
                        }
                      },
                      "insertId": {
                        "primitiveDataType": "STRING"
                      }
                    }
                  }
                }
              }
            }
          }]
        }
      },
      "detectionPriority": {
        "primitiveDataType": "STRING"
      },
      "findingId": {
        "primitiveDataType": "STRING"
      },
      "contextUris": {
        "structValue": {
          "fields": {
            "mitreUri": {
              "dataType": "HYPERLINK",
              "structValue": {
                "fields": {
                  "display_name": {
                    "primitiveDataType": "STRING"
                  },
                  "url": {
                    "primitiveDataType": "STRING"
                  }
                }
              }
            },
            "cloudLoggingQueryUri": {
              "listValues": {
                "propertyDataTypes": [{
                  "dataType": "HYPERLINK",
                  "structValue": {
                    "fields": {
                      "display_name": {
                        "primitiveDataType": "STRING"
                      },
                      "url": {
                        "primitiveDataType": "STRING"
                      }
                    }
                  }
                }]
              }
            },
            "relatedFindingUri": {
              "dataType": "HYPERLINK",
              "structValue": {
                "fields": {
                  "display_name": {
                    "primitiveDataType": "STRING"
                  },
                  "url": {
                    "primitiveDataType": "STRING"
                  }
                }
              }
            }
          }
        }
      },
      "detectionCategory": {
        "structValue": {
          "fields": {
            "technique": {
              "primitiveDataType": "STRING"
            },
            "indicator": {
              "primitiveDataType": "STRING"
            },
            "ruleName": {
              "primitiveDataType": "STRING"
            },
            "subRuleName": {
              "primitiveDataType": "STRING"
            }
          }
        }
      },
      "affectedResources": {
        "listValues": {
          "propertyDataTypes": [{
            "structValue": {
              "fields": {
                "gcpResourceName": {
                  "primitiveDataType": "STRING"
                }
              }
            }
          }]
        }
      },
      "properties": {
        "structValue": {
          "fields": {
            "sensitiveRoleGrant": {
              "structValue": {
                "fields": {
                  "principalEmail": {
                    "primitiveDataType": "STRING"
                  },
                  "members": {
                    "listValues": {
                      "propertyDataTypes": [{
                        "primitiveDataType": "STRING"
                      }]
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "severity": "HIGH",
    "workflowState": "NEW",
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "projectDisplayName": "PROJECT_ID",
    "parentName": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID",
    "parentDisplayName": "PARENT_NAME",
    "type": "google.cloud.resourcemanager.Project",
    "folders": [{
      "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID",
      "resourceFolderDisplayName": "PARENT_NAME"
    }]
  }
}
    

What's next