이 문서는 Cloud Run 리소스에서 의심스러운 활동이 발견되었을 때 대응하는 방법에 관한 비공식 가이드를 제공합니다. 권장 단계가 모든 발견 결과에 적합하지 않을 수 있으며 작업에 영향을 미칠 수 있습니다. 조치를 취하기 전에 결과를 조사하고, 수집한 정보를 평가하고, 대응 방법을 결정해야 합니다.
이 문서의 기법이 과거, 현재 또는 미래의 모든 위협에 대해 효과적이라고 보장할 수는 없습니다. Security Command Center에서 위협에 대한 공식 해결 방법을 제공하지 않는 이유를 알아보려면 위협 해결을 참고하세요.
시작하기 전에
결과 검토
영향을 받는 컨테이너와 감지된 바이너리, 프로세스 또는 라이브러리를 기록합니다.
조사 중인 발견 항목에 대해 자세히 알아보려면 위협 발견 항목 색인에서 발견 항목을 검색하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document offers informal guidance on how you can respond to findings of suspicious\nactivities in your Cloud Run resources. The recommended steps might not be appropriate for all\nfindings and might impact your operations. Before you take any action, you should investigate the\nfindings; assess the information that you gather; and decide how to respond.\n\nThe techniques in this document aren't guaranteed to be effective against any previous, current,\nor future threats that you face. To understand why Security Command Center does not provide official\nremediation guidance for threats, see [Remediating threats](/security-command-center/docs/how-to-investigate-threats#remediating_threats).\n\nBefore you begin\n\n1. [Review the\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). Note the affected container and the detected binaries, processes, or libraries.\n2. To learn more about the finding that you're investigating, search for the finding in the [Threat findings\n index](/security-command-center/docs/threat-findings-index).\n\nGeneral recommendations\n\n- Contact the owner of the affected resource.\n- [View the logs](/run/docs/logging#viewing-logs) for the potentially compromised Cloud Run service or job.\n- For forensic analysis, collect and back up the logs from the affected service or job.\n- For further investigation, consider using incident response services like [Mandiant](/security/consulting/mandiant-incident-response-services).\n- Consider deleting the affected Cloud Run service or service revision:\n - To delete the service, see [Delete existing\n services](/run/docs/managing/services#delete).\n - To delete the service revision, [roll back to a previous\n revision](/run/docs/rollouts-rollbacks-traffic-migration#rollback) or deploy a new, more secure revision. Then, [delete the affected\n revision](/run/docs/managing/revisions#delete).\n- Consider [deleting the affected Cloud Run\n job](/run/docs/managing/jobs#delete).\n\nMalicious script or Python code executed\n\nIf the script or Python code was making intended changes to the container,\n[deploy a revision](/run/docs/deploying#revision) to the service that has all\nthe intended changes. Don't rely on a script to make changes after the container\nis deployed.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
