Overview of custom modules for Event Threat Detection

This page provides an overview of custom modules for Event Threat Detection.

You can configure modules, also known as detectors , to process your Cloud Logging stream and detect threats based on parameters you specify. This feature extends the monitoring capabilities of Event Threat Detection and lets you add modules with your own detection parameters, remediation guidance, and severity designations for configurations that the built-in detectors might not support.

Custom modules are useful if you need modules with detection rules that meet the unique needs of your organization. For example, you can add a custom module that creates findings if log entries show that a resource is connected to specific IP addresses or is created in a restricted region.

How custom modules for Event Threat Detection work

Custom modules are a select group of Event Threat Detection detectors that you can configure with your own detection parameters. You can create an Event Threat Detection custom module through the Google Cloud console. Alternatively, you can create one by updating a custom module template and sending the custom module to Security Command Center through the Google Cloud CLI. For information about available templates, see Custom modules and templates .

Custom module templates are written in JSON and let you define detection parameters that control what events in log entries should trigger findings. For example, the built-in Malware: Bad IP detector checks Virtual Private Cloud Flow Logs for evidence of connections to known suspicious IP addresses. However, you can enable and modify the Configurable Bad IP custom module with a list of suspicious IP addresses that you maintain. If your logs indicate a connection to any of your supplied IP addresses, a finding is generated and written to Security Command Center.

Module templates also let you define the severity of threats and provide custom remediation steps to help your security teams fix issues.

With custom modules, you have more control over how Event Threat Detection detects threats and reports findings. Custom modules include your supplied parameters, but still utilize Event Threat Detection's proprietary detection logic and threat intelligence, including tripwire indicator matching. You can implement a broad set of threat models tailored to your organization's unique requirements.

Event Threat Detection custom modules run alongside the built-in detectors. Enabled modules run in real-time mode, which triggers scans whenever new logs are created.

Custom modules and templates

The following table contains a list of supported custom module types, descriptions, required logs, and JSON module templates.

You need these JSON module templates if you want to use the gcloud CLI to create or update custom modules. To see a template, click the expand icon add_circle next to its name. For information about using custom modules, see Configure and manage custom modules .

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "ips": [
    " IP_ADDRESS_1 
",
    " IP_ADDRESS_2 
"
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "domains": [
    " DOMAIN_1 
"," DOMAIN_2 
"
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "instances": [
    {
      "series": " SERIES 
",
      "cpus": {
        "minimum": MINIMUM_NUMBER_OF_CPUS 
,
        "maximum": MAXIMUM_NUMBER_OF_CPUS 
},
      "ram_mb": {
        "minimum": MINIMUM_RAM_SIZE 
,
        "maximum": MAXIMUM_RAM_SIZE 
},
      "gpus": {
        "minimum": MINIMUM_NUMBER_OF_GPUS 
,
        "maximum": MAXIMUM_NUMBER_OF_GPUS 
},
      "projects": [
        " PROJECT_ID_1 
",
        " PROJECT_ID_2 
"
      ],
      "regions": [
        " REGION_1 
",
        " REGION_2 
"
      ]
    },
    {
      "series": " ... ",
      ...
      "regions": [ ... ]
    }
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "patterns": [
    {

      "pattern": " PATTERN_1 
",
      "name": " NAME_1 
"
    },
    {
      "pattern": " PATTERN_2 
",
      "name": " NAME_2 
"
    }
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "regions": [
    {
      "region": " REGION_1 
"
    },
    {
      "region": " REGION_2 
"
    }
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "accounts": [
    " BREAKGLASS_ACCOUNT_1 
", " BREAKGLASS_ACCOUNT_2 
"
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "roles": [" ROLE_1 
", " ROLE_2 
"]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "permissions": [
    " PERMISSION_1 
",
    " PERMISSION_2 
"
  ]
}

{
  "metadata": {
    "severity": " SEVERITY 
",
    "description": " DESCRIPTION 
",
    "recommendation": " RECOMMENDATION 
"
  },
  "caller_pattern": " CALLER_PATTERN 
",
  "method_pattern": " METHOD_PATTERN 
",
  "resource_pattern": " RESOURCE_PATTERN 
"
}

Pricing and quota

This feature is free of charge to Security Command Center Premium customers.

Event Threat Detection custom modules are subject to quota limits.

The default quota limit for the creation of custom modules is 200.

API calls to custom module methods are also subject to quota limits. The following table shows the default quota limits for custom module API calls.

Module size limits

Each Event Threat Detection custom module has a size limit of 6 MB.

Rate limits

The following rate limits apply:

• 30 findings per custom module per hour.
• 200 custom module findings per parent resource (organization or project) per hour. Each finding counts towards either an organization or project, depending on which level the source custom module was created in.

These limits can't be increased.

What's next

• Learn how to create and manage custom modules .