Como usar o Serviço de ações sensíveis

Esta página mostra como revisar as descobertas do Serviço de ações confidenciais no Console do Google Cloud e inclui exemplos dessas descobertas.

O serviço de ações confidenciais é um serviço integrado do Security Command Center que detecta quando ações são realizadas em sua organização, pastas e projetos do Google Cloud que podem prejudicar sua empresa se forem tomadas por um agente mal-intencionado. Para saber mais, consulte Visão geral do Serviço de ações confidenciais.

Como analisar as descobertas do Serviço de ações sensíveis

O serviço de ações confidenciais é sempre ativado quando você é ativado para o nível Standard do Security Command Center e não pode ser desativado. Para mais informações sobre os tipos de descoberta do Serviço de ações sensíveis, consulte Descobertas.

Quando o Serviço de ações sensíveis detecta uma ação considerada sensível, ele cria uma descoberta e uma entrada de registro. É possível visualizar a descoberta no Console do Google Cloud. É possível consultar as entradas de registro no Cloud Logging. Para testar o serviço de ações confidenciais, execute uma ação confidencial e verifique se a descoberta aparece na página Descobertas no Console do Google Cloud. Para mais informações, consulte Como testar o Serviço de ações confidenciais.

Como analisar as descobertas no Security Command Center

Os papéis do IAM para o Security Command Center podem ser concedidos no nível da organização, da pasta ou do projeto. A capacidade de ver, editar, criar ou atualizar descobertas, recursos e fontes de segurança depende do nível a que você tem acesso. Para saber mais sobre os papéis do Security Command Center, consulte Controle de acesso.

Para analisar as descobertas do serviço de ações confidenciais no console do Google Cloud, siga estas etapas:

  1. No console do Google Cloud, acesse a página Descobertas do Security Command Center.

    Acesse Descobertas

  2. Se necessário, selecione o projeto ou a organização do Google Cloud.

    Seletor de projetos

  3. Na seção Filtros rápidos, na subseção Nome de exibição da origem, selecione Serviço de ações sensíveis.

    A tabela é preenchida com descobertas do Serviço de ações sensíveis.

  4. Para ver detalhes sobre uma descoberta específica, clique no nome da descoberta em Category. O Painel de detalhes da descoberta é expandido para mostrar informações, incluindo:

    • Um resumo gerado por IAVisualização do problema
    • Quando o evento ocorreu
    • A fonte dos dados de descoberta
    • A gravidade de detecção, por exemplo, Alta
    • As ações realizadas, como adicionar um papel de proprietário ou editor no nível da organização a um usuário do Gmail
    • O usuário que realizou a ação, listado ao lado de E-mail principal

  5. Para exibir todas as descobertas causadas pelas ações do mesmo usuário:

    1. No Painel de detalhes da descoberta, copie o endereço de e-mail ao lado de E-mail principal.
    2. Fechar painel.

    3. No criador de consultas, insira a consulta a seguir:

      access.principal_email="USER_EMAIL"

      Substitua USER_EMAIL pelo endereço de e-mail que você copiou anteriormente.

      O Security Command Center exibe todas as descobertas associadas a ações realizadas pelo usuário que você especificou.

Como visualizar descobertas no Cloud Logging

O serviço de ações confidenciais grava uma entrada de registro nos registros do Google Cloud Platform para cada ação confidencial, se for encontrada. Essas entradas de registro são gravadas mesmo se você não tiver ativado o Security Command Center.

Para visualizar as entradas de registro de ações sensíveis no Cloud Logging, faça o seguinte:

  1. Acesse o Explorador de registros no console do Google Cloud.

    Acessar o Explorador de registros

  2. No Seletor de projetos na parte superior da página, escolha o projeto para o qual você quer ver as entradas de registro do Serviço de ações sensíveis. Como alternativa, para ver as entradas de registro no nível da organização, selecione a organização.

  3. Na caixa de texto Consulta, insira a seguinte definição de recurso: resource.type="sensitiveaction.googleapis.com/Location"

  4. Selecione Executar consulta. A tabela Resultados da consulta é atualizada com todas as entradas de registro correspondentes que foram gravadas no período da sua consulta.

  5. Para visualizar os detalhes de uma entrada de registro, clique em uma linha da tabela e em Expandir campos aninhados.

É possível criar consultas avançadas de registros para especificar um conjunto de entradas de registros de qualquer número.

Exemplos de formatos de descoberta

Esta seção inclui a saída JSON para as descobertas do Serviço de ações confidenciais conforme elas aparecem ao criar exportações do Console do Google Cloud ou executar métodos de lista na API Security Command Center.

Os exemplos de saída contêm os campos mais comuns a todas as descobertas. No entanto, é possível que nem todos os campos apareçam em todas as descobertas. A saída real que você vê depende da configuração de um recurso e do tipo e do estado das descobertas.

Para ver exemplos de descobertas, expanda um ou mais dos seguintes nós.

Evasão de defesa: alteração na política da organização

Essa descoberta não está disponível para ativações no nível do projeto. 

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {
              "regionCode": "US"
            },
            "serviceName": "orgpolicy.googleapis.com",
            "methodName": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
            "principalSubject": "user:PRINCIPAL_EMAIL"
          },
          "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Defense Evasion: Organization Policy Changed",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-27T12:35:30.466Z",
          "database": {},
          "eventTime": "2022-08-27T12:35:30.264Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "DEFENSE_EVASION",
            "primaryTechniques": [
              "IMPAIR_DEFENSES"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions",
          "resourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention",
          "display_name": "",
          "project_name": "",
          "project_display_name": "",
          "parent_name": "",
          "parent_display_name": "",
          "type": "",
          "folders": []
        },
        "sourceProperties": {
          "sourceId": {
            "organizationNumber": "ORGANIZATION_ID",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "change_organization_policy"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID"
            },
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
            },
            {
              "gcpResourceName": "//orgpolicy.googleapis.com/organizations/ORGANIZATION_ID/policies/storage.publicAccessPrevention"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "resourceContainer": "organizations/ORGANIZATION_ID",
                "timestamp": {
                  "seconds": "1661603725",
                  "nanos": 12242032
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1562/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-27T12:35:25.012242032Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Evasão de defesa: remover administrador de faturamento

Essa descoberta não está disponível para ativações no nível do projeto. 

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {},
            "serviceName": "cloudresourcemanager.googleapis.com",
            "methodName": "SetIamPolicy",
            "principalSubject": "user:PRINCIPAL_EMAIL"
          },
          "assetDisplayName": "organizations/ORGANIZATION_ID",
          "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
          "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Defense Evasion: Remove Billing Admin",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-31T14:47:11.752Z",
          "database": {},
          "eventTime": "2022-08-31T14:47:11.256Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "iamBindings": [
            {
              "action": "REMOVE",
              "role": "roles/billing.admin",
              "member": "user:PRINCIPAL_ACCOUNT_CHANGED"
            }
          ],
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "DEFENSE_EVASION",
            "primaryTechniques": [
              "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions Service",
          "resourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
          "display_name": "ORGANIZATION_NAME",
          "project_name": "",
          "project_display_name": "",
          "parent_name": "",
          "parent_display_name": "",
          "type": "google.cloud.resourcemanager.Organization",
          "folders": []
        },
        "sourceProperties": {
          "sourceId": {
            "organizationNumber": "ORGANIZATION_ID",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "remove_billing_admin"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "resourceContainer": "organizations/ORGANIZATION_ID",
                "timestamp": {
                  "seconds": "1661957226",
                  "nanos": 356329000
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1578/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-31T14:47:06.356329Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Impacto: instância de GPU criada

      {
        "findings": {
          "access": {
            "principalEmail": "PRINCIPAL_EMAIL",
            "callerIp": "PRINCIPAL_IP_ADDRESS",
            "callerIpGeo": {
              "regionCode": "US"
            },
            "serviceName": "compute.googleapis.com",
            "methodName": "beta.compute.instances.insert"
          },
          "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",
          "category": "Impact: GPU Instance Created",
          "contacts": {
            "technical": {
              "contacts": [
                {
                  "email": "EMAIL_ADDRESS_1"
                },
                {
                  "email": "EMAIL_ADDRESS_2"
                },
              ]
            }
          },
          "createTime": "2022-08-11T19:13:11.134Z",
          "database": {},
          "eventTime": "2022-08-11T19:13:09.885Z",
          "exfiltration": {},
          "findingClass": "OBSERVATION",
          "indicator": {},
          "kubernetes": {},
          "mitreAttack": {
            "primaryTactic": "IMPACT",
            "primaryTechniques": [
              "RESOURCE_HIJACKING"
            ]
          },
          "mute": "UNDEFINED",
          "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
          "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
          "parentDisplayName": "Sensitive Actions",
          "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
          "severity": "LOW",
          "sourceDisplayName": "Sensitive Actions Service",
          "state": "ACTIVE",
          "vulnerability": {},
          "workflowState": "NEW"
        },
        "resource": {
          "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
          "display_name": "VM_INSTANCE_NAME",
          "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "project_display_name": "PROJECT_ID",
          "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "parent_display_name": "PROJECT_ID",
          "type": "google.compute.Instance",
          "folders": [
            {
              "resourceFolderDisplayName": "FOLDER_NAME",
              "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
            }
          ]
        },
        "sourceProperties": {
          "sourceId": {
            "projectNumber": "PROJECT_NUMBER",
            "customerOrganizationNumber": "ORGANIZATION_ID"
          },
          "detectionCategory": {
            "ruleName": "sensitive_action",
            "subRuleName": "gpu_instance_created"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
            },
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "projectId": "PROJECT_ID",
                "resourceContainer": "projects/PROJECT_ID",
                "timestamp": {
                  "seconds": "1660245184",
                  "nanos": 578768000
                },
                "insertId": "INSERT_ID"
              }
            }
          ],
          "properties": {},
          "findingId": "FINDING_ID",
          "contextUris": {
            "mitreUri": {
              "displayName": "MITRE Link",
              "url": "https://attack.mitre.org/techniques/T1496/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-11T19:13:04.578768Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
              }
            ],
            "relatedFindingUri": {}
          }
        }
      }

Impacto: muitas instâncias criadas

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIpGeo": {},
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.instances.insert",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Impact: Many Instances Created",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-22T21:18:18.112Z",
        "database": {},
        "eventTime": "2022-08-22T21:18:17.759Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "IMPACT",
          "primaryTechniques": [
            "RESOURCE_HIJACKING"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "display_name": "",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Instance",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "many_instances_created"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661203092",
                "nanos": 314642000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1496/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-22T21:18:12.314642Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Impacto: várias instâncias excluídas

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIpGeo": {},
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.instances.delete",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Impact: Many Instances Deleted",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-22T21:21:11.432Z",
        "database": {},
        "eventTime": "2022-08-22T21:21:11.144Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "IMPACT",
          "primaryTechniques": [
            "DATA_DESTRUCTION"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME",
        "display_name": "VM_INSTANCE_NAME",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Instance",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "many_instances_deleted"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661203265",
                "nanos": 669160000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1485/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-22T21:21:05.669160Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Persistência: adicionar papel sensível

Essa descoberta não está disponível para ativações no nível do projeto. 

{
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIp": "PRINCIPAL_IP_ADDRESS",
          "callerIpGeo": {},
          "serviceName": "cloudresourcemanager.googleapis.com",
          "methodName": "SetIamPolicy",
          "principalSubject": "user:PRINCIPAL_EMAIL"
        },
        "assetDisplayName": "organizations/ORGANIZATION_ID",
        "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
        "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
        "category": "Persistence: Add Sensitive Role",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-31T17:20:13.305Z",
        "database": {},
        "eventTime": "2022-08-31T17:20:11.929Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "iamBindings": [
          {
            "action": "ADD",
            "role": "roles/editor",
            "member": "user:PRINCIPAL_ACCOUNT_CHANGED"
          }
        ],
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "PERSISTENCE",
          "primaryTechniques": [
            "ACCOUNT_MANIPULATION"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
        "parentDisplayName": "Sensitive Actions Service",
        "resourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions Service",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
        "display_name": "ORGANIZATION_NAME",
        "project_name": "",
        "project_display_name": "",
        "parent_name": "",
        "parent_display_name": "",
        "type": "google.cloud.resourcemanager.Organization",
        "folders": []
      },
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "add_sensitive_role"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1661966410",
                "nanos": 132148000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-31T17:20:10.132148Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project="
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Persistência: chave SSH do projeto adicionada

    {
      "findings": {
        "access": {
          "principalEmail": "PRINCIPAL_EMAIL",
          "callerIp": "PRINCIPAL_IP_ADDRESS",
          "callerIpGeo": {
            "regionCode": "US"
          },
          "serviceName": "compute.googleapis.com",
          "methodName": "v1.compute.projects.setCommonInstanceMetadata",
          "principalSubject": "user:USER_EMAIL"
        },
        "canonicalName": "projects/PROJECT_NUMBER/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "category": "Persistence: Project SSH Key Added",
        "contacts": {
          "technical": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS_1"
              },
              {
                "email": "EMAIL_ADDRESS_2"
              },
            ]
          }
        },
        "createTime": "2022-08-25T13:24:43.142Z",
        "database": {},
        "eventTime": "2022-08-25T13:24:42.719Z",
        "exfiltration": {},
        "findingClass": "OBSERVATION",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
        "indicator": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "PERSISTENCE",
          "primaryTechniques": [
            "ACCOUNT_MANIPULATION",
            "SSH_AUTHORIZED_KEYS"
          ]
        },
        "mute": "UNDEFINED",
        "name": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SENSITIVE_ACTIONS_INSTANCE_NUMBER",
        "parentDisplayName": "Sensitive Actions",
        "resourceName": "//compute.googleapis.com/projects/PROJECT_ID",
        "severity": "LOW",
        "sourceDisplayName": "Sensitive Actions",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
      },
      "resource": {
        "name": "//compute.googleapis.com/projects/PROJECT_ID",
        "display_name": "PROJECT_ID",
        "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "project_display_name": "PROJECT_ID",
        "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "parent_display_name": "PROJECT_ID",
        "type": "google.compute.Project",
        "folders": [
          {
            "resourceFolderDisplayName": "FOLDER_NAME",
            "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
          }
        ]
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "sensitive_action",
          "subRuleName": "add_ssh_key"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//compute.googleapis.com/projects/PROJECT_ID"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1661433879",
                "nanos": 413362000
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/004/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-25T13:24:39.413362Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

A seguir