Detection services

This page contains a list of the detection services, sometimes also referred to as security sources , that Security Command Center uses to detect security issues in your cloud environments.

When these services detect an issue, they generate a finding , which is a record that identifies the security issue and provides you with the information you need to prioritize and resolve the issue.

You can view findings in the Google Cloud console and filter them in many different ways, such as by finding type, resource type, or for a specific asset. Each security source might provide more filters to help you organize your findings.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control .

Vulnerability detection services

Vulnerability detection services include built-in and integrated services that detect software vulnerabilities, misconfigurations, and posture violations in your cloud environments. Collectively, these types of security issues are referred to as vulnerabilities .

Artifact Registry vulnerability assessment

Artifact Registry vulnerability assessment is a detection service that alerts you to vulnerabilities in your deployed container images.

This detection service generates vulnerability findings for container images under the following conditions:

• The container image is stored in Artifact Registry .

• The container image is deployed to one of the following assets:

  • Google Kubernetes Engine cluster
  • Cloud Run service
  • Cloud Run job
  • App Engine

Artifact Registry vulnerability assessment won't generate findings for container images that don't meet this criteria.

If you enable Artifact Registry vulnerability assessment with Security Command Center, Artifact Registry vulnerability assessment automatically writes high and critical findings to Security Command Center. If your container images have vulnerabilities categorized as medium or low, you can manage them in the Artifact Registry vulnerability assessment, but Security Command Center doesn't display them.

After Artifact Registry vulnerability assessment findings are generated, they remain available for you to query up to five weeks after the last container image scan performed. For more information about Security Command Center data retention, see Data retention .

Enable Artifact Registry vulnerability assessment findings

For Artifact Registry vulnerability assessment to generate findings in Security Command Center for deployed container images stored in Artifact Registry, the Container Scanning API must be enabled for your project.

If you haven't enabled the Container Scanning API, do the following:

1. In the Google Cloud console, go to the Container Scanning APIpage.

   Go to Container Scanning API

2. Select the project you want to enable the Container Scanning API for.

3. Click Enable.

Security Command Center will display findings for scanned vulnerable container images that are actively deployed to the applicable runtime assets . However, the detection service behaves differently depending on when you enabled Security Command Center and when you enabled the Container Scanning API.

Disable Artifact Registry vulnerability assessment findings

To disable Artifact Registry vulnerability assessment findings, do the following:

1. In the Google Cloud console, go to the API/Service Detailspage for the Container Scanning API.

   Go to API/Service Details

2. Select the project you want to disable the Container Scanning API for.

3. Click Disable API.

Security Command Center won't display findings for vulnerabilities detected in future container image scans. Security Command Center retains any existing Artifact Registry vulnerability assessment findings for at least 35 days after the last container image scan performed. For more information about Security Command Center data retention, see Data retention .

You can also disable Artifact Registry vulnerability assessment by disabling the Vulnerability Assessment source ID in the Security Command Center settings; however, we don't recommend this. Disabling the Vulnerability Assessment source ID will disable all the detection services classified under the Vulnerability Assessment source ID. Therefore, we recommend disabling the Container Scanning API with the preceding procedure.

View Artifact Registry vulnerability assessment findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select Vulnerability Assessment . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

Data Security Posture Management findings

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms . Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions .

Data Security Posture Management (DSPM) creates findings for potential violations to the data security frameworks and cloud controls that you apply in your environment. You can view these findings on the Data Security & Compliancepage, the Risk Overviewpage (under the Datatab), or in the Findingspage in Security Command Center.

View DSPM findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select Data Security Posture Management . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

GKE security posture dashboard

The Google Kubernetes Engine (GKE) security posture dashboard is a page in the Google Cloud console that provides you with opinionated, actionable findings about potential security issues in your GKE clusters.

To see these findings, enable any of the following GKE security posture dashboard features:

The findings display information about the security issue and provide recommendations to resolve them in your workloads or clusters.

View GKE security posture dashboard findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select GKE Security Posture . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

IAM recommender

IAM recommender generates recommendations that you can follow to improve security by removing or replacing IAM roles from principals when the roles contain IAM permissions that the principal does not need.

IAM recommender is automatically enabled when you activate Security Command Center.

Enable or disable IAM recommender findings

To enable or disable IAM recommender findings in Security Command Center, follow these steps:

1. Go to the Integrated servicestab of the Security Command Center Settingspage in the Google Cloud console:

   Go to Integrated services

2. Go to the IAM recommenderentry.

3. To the right of the entry, select Enableor Disable.

Findings from IAM recommender are classified as vulnerabilities.

To remediate an IAM recommender finding, expand the following section to see a table of the IAM recommender findings. The remediation steps for each finding are included in the table entry.

View IAM recommender findings in the console

Select the tab specific to your service tier.

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select IAM Recommender . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

In the Premier tier, you can also view the IAM recommender findings on the Vulnerabilities page by selecting the IAM recommenderquery preset.

Mandiant Attack Surface Management

Mandiant is a world leader in frontline threat intelligence. Mandiant Attack Surface Management identifies vulnerabilities and misconfigurations in your external attack surfaces to help you stay up-to-date against the latest cyber attacks.

Mandiant Attack Surface Management is automatically enabled when you activate the Security Command Center Enterprise tier and findings are available in the Google Cloud console.

For information about how the standalone Mandiant Attack Surface Management product differs from the Mandiant Attack Surface Management integration within Security Command Center, see ASM and Security Command Center on the Mandiant documentation portal. This link requires Mandiant authentication.

Review Mandiant Attack Surface Management findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select Mandiant Attack Surface Management . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

Neither Security Command Center nor Mandiant Attack Surface Management mark findings as resolved. Once you resolve an issue, you can manually mark the issue resolved. If it is not identified in the next Mandiant Attack Surface Management scan, it stays resolved.

Model Armor

Model Armor is a fully managed Google Cloud service that enhances the security and safety of AI applications by screening LLM prompts and responses.

Vulnerability findings from the Model Armor service

Notebook Security Scanner

Notebook Security Scanner is a built-in package vulnerability detection service of Security Command Center. After Notebook Security Scanner is enabled, it automatically scans Colab Enterprise notebooks (files with the ipynb filename extension) every 24 hours to detect vulnerabilities in Python packages and publishes these findings to the Security Command Center Findingspage.

You can use Notebook Security Scanner for Colab Enterprise notebooks that are created in the following regions: us-central1 , us-east4 , us-west1 , and europe-west4 .

To get started with Notebook Security Scanner, see Enable and use Notebook Security Scanner .

Policy Controller

Policy Controller enables the application and enforcement of programmable policies for your Kubernetes clusters. These policies act as guardrails and can help with best practices, security, and compliance management of your clusters and fleet.

If you install Policy Controller , and enable any of the Policy Controller bundles , Policy Controller automatically writes cluster violations to Security Command Center as Misconfiguration class findings. The finding description and next steps in the Security Command Center findings are the same as the constraint description and remediation steps of the corresponding Policy Controller bundle.

The Policy Controller findings come from the following Policy Controller bundles:

• CIS Kubernetes Benchmark v.1.5.1 , a set of recommendations for configuring Kubernetes to support a strong security posture. You can also view information about this bundle in the GitHub repository for cis-k8s-v1.5.1 .
• PCI-DSS v3.2.1 , a bundle which evaluates the compliance of your cluster resources against some aspects of the Payment Card Industry Data Security Standard (PCI-DSS) v3.2.1. You can also view information about this bundle in the GitHub repository for pci-dss-v3 .

To find and remediate Policy Controller findings, see Remediating Policy Controller findings .

Risk Engine

The Security Command Center Risk Engine assesses the risk exposure of your cloud deployments, assigns attack exposure scores to vulnerability findings and your high-value resources, and diagrams paths that a potential attacker could take to reach your high-value resources.

In the Enterprise or Premium tier of Security Command Center, the Risk Engine detects groups of security issues that, when they occur together in a particular pattern, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources.

When Risk Engine detects one of these combinations, it generates a TOXIC_COMBINATION class finding. In the finding, Risk Engine is listed as the source of the finding.

Risk Engine also identifies common resources or resource groups where multiple attack paths converge, and then generates a CHOKEPOINT class finding.

For more information, see Toxic combinations and chokepoints overview .

Security Health Analytics

Security Health Analytics is a built-in detection service of Security Command Center that provides managed scans of your cloud resources to detect common misconfigurations.

When a misconfiguration is detected, Security Health Analytics generates a finding. Most Security Health Analytics findings are mapped to security standard controls so that you can assess compliance.

Security Health Analytics scans your resources on Google Cloud. If you are using the Enterprise tier and establish connections to other cloud platforms, Security Health Analytics can also scan your resources on those cloud platforms.

Depending on the Security Command Center service tier you are using, the available detectors differ:

• In the Standard tier, Security Health Analytics includes only a basic group of medium-severity and high-severity vulnerability detectors.
• The Premium tier includes all vulnerability detectors for Google Cloud.
• The Enterprise tier includes additional detectors for other cloud platforms.

Security Health Analytics is automatically enabled when you activate Security Command Center.

For more information, see:

• Security Health Analytics overview
• How to use Security Health Analytics
• Remediating Security Health Analytics findings
• Reference of Security Health Analytics findings

Security posture service

The security posture service is a built-in service for the Security Command Center Premium tier that lets you define, assess, and monitor the overall status of your security in Google Cloud. It provides information about how your environment aligns with the policies that you define in your security posture.

The security posture service isn't related to the GKE security posture dashboard , which only shows findings in GKE clusters.

Sensitive Data Protection

Sensitive Data Protection is a fully managed Google Cloud service that helps you discover, classify, and protect your sensitive data. You can use Sensitive Data Protection to determine whether you're storing sensitive or personally identifiable information (PII), like the following:

• Person names
• Credit card numbers
• National or state ID numbers
• Health insurance ID numbers
• Secrets

In Sensitive Data Protection, each type of sensitive data that you search for is called an infoType .

If you configure your Sensitive Data Protection operation to send results to Security Command Center, you can see the findings directly in the Security Command Center section of the Google Cloud console, in addition to the Sensitive Data Protection section.

Vulnerability findings from the Sensitive Data Protection discovery service

The Sensitive Data Protection discovery service helps you determine whether you are storing highly sensitive data that is not protected.

Misconfiguration findings from the Sensitive Data Protection discovery service

The Sensitive Data Protection discovery service helps you determine whether you have misconfigurations that might expose sensitive data.

Observation findings from Sensitive Data Protection

This section describes the observation findings that Sensitive Data Protection generates in Security Command Center.

Observation findings from the discovery service

The Sensitive Data Protection discovery service helps you determine whether your data contains specific infoTypes and where they reside in your organization, folders, and projects. It generates the following observation finding categories in Security Command Center:

Data sensitivity

An indication of the sensitivity level of the data in a particular data asset. Data is sensitive if it contains PII or other elements that might require additional control or management. The severity of the finding is the sensitivity level that Sensitive Data Protection calculated when generating the data profile.

Data risk

The risk associated with the data in its current state. When calculating data risk, Sensitive Data Protection considers the sensitivity level of the data in the data asset and the presence of access controls to protect that data. The severity of the finding is the data risk level that Sensitive Data Protection calculated when generating the data profile.

Depending on the size of your organization, Sensitive Data Protection findings can start appearing in Security Command Center within a few minutes after you enable sensitive data discovery. For larger organizations or organizations with specific configurations that affect finding generation, it can take up to 12 hours before initial findings appear in Security Command Center.

Subsequently, Sensitive Data Protection generates findings in Security Command Center within a few minutes after the discovery service scans your resources.

For information about how to send data profile results to Security Command Center, see the following:

• For Security Command Center Enterprise: Enable sensitive data discovery .
• For Security Command Center Premium or Standard: Publish data profiles to Security Command Center .

Observation findings from the Sensitive Data Protection inspection service

A Sensitive Data Protection inspection job identifies each instance of data of a specific infoType in a storage system like a Cloud Storage bucket or a BigQuery table. For example, you can run an inspection job that searches for all strings that match the CREDIT_CARD_NUMBER infoType detector in a Cloud Storage bucket.

For each infoType detector that has one or more matches, Sensitive Data Protection generates a corresponding Security Command Center finding. The finding category is the name of the infoType detector that had a match—for example, Credit card number . The finding includes the number of matching strings that were detected in text or images in the resource.

For security reasons, the actual strings that were detected aren't included in the finding. For example, a Credit card number finding shows how many credit card numbers were found, but doesn't show the actual credit card numbers.

Because there are more than 150 built-in infoType detectors in Sensitive Data Protection, all possible Security Command Center finding categories aren't listed here. For a full list of infoType detectors, see InfoType detector reference .

For information on how to send the results of an inspection job to Security Command Center, see Send Sensitive Data Protection inspection job results to Security Command Center .

Review Sensitive Data Protection findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select Sensitive Data Protection . The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.

VM Manager

VM Manager is a suite of tools that can be used to manage operating systems for large virtual machine (VM) fleets running Windows and Linux on Compute Engine.

To use VM Manager with project-level activations of Security Command Center Premium, activate Security Command Center Standard in the parent organization.

If you enable VM Manager with the Security Command Center Premium tier, VM Manager automatically writes high and critical findings from its vulnerability reports , which are in preview, to Security Command Center. The reports identify vulnerabilities in operating systems (OS) that are installed on VMs, including Common Vulnerabilities and Exposures (CVEs) .

Vulnerability reports are not available for Security Command Center Standard.

Findings simplify the process of using VM Manager's Patch Compliance feature, which is in preview. The feature lets you conduct patch management at the organization level across all of your projects. VM Manager supports patch management at the single project level.

To remediate VM Manager findings, see Remediating VM Manager findings .

To stop vulnerability reports from being written to Security Command Center, see Mute VM Manager findings .

Vulnerabilities of this type all relate to installed operating system packages in supported Compute Engine VMs.

Vulnerability Assessment for AWS

The Vulnerability Assessment for Amazon Web Services (AWS) service detects software vulnerabilities in your workloads that are running on EC2 virtual machines (VMs) on the AWS cloud platform.

For each detected vulnerability, Vulnerability Assessment for AWS generates a Vulnerability class finding in the Software vulnerability finding category in Security Command Center.

The Vulnerability Assessment for AWS service scans snapshots of the running EC2 machine instances, so production workloads are unaffected. This scan method is called agentless disk scanning , because no agents are installed the scan targets.

For more information, see the following:

• Overview of Vulnerability Assessment for AWS
• Enable and use Vulnerability Assessment for AWS

Vulnerability Assessment for Google Cloud

The Vulnerability Assessment for Google Cloud service detects software vulnerabilities in the following resources on the Google Cloud platform:

• Running Compute Engine VM instances
• Nodes in GKE Standard clusters
• Containers running in GKE Standard and GKE Autopilot clusters

For each detected vulnerability, Vulnerability Assessment for Google Cloud generates a Vulnerability class finding in the Software vulnerability or OS vulnerability finding category in Security Command Center.

The Vulnerability Assessment for Google Cloud service scans your Compute Engine VM instances by cloning their disks approximately every 12 hours, mounting them in a secure VM instance, and assessing them with the SCALIBR scanner.

For more information, see Vulnerability Assessment for Google Cloud .

Web Security Scanner

Web Security Scanner provides managed and custom web vulnerability scanning for public App Engine, GKE, and Compute Engine serviced web applications.

Managed scans

Web Security Scanner managed scans are configured and managed by Security Command Center. Managed scans automatically run once each week to detect and scan public web endpoints. These scans don't use authentication and they send GET-only requests so they don't submit any forms on live websites.

Managed scans run separately from custom scans.

If Security Command Center is activated at the organization level , you can use managed scans to centrally manage basic web application vulnerability detection for projects in your organization, without having to involve individual project teams. When findings are discovered, you can work with those teams to set up more comprehensive custom scans.

When you enable Web Security Scanner as a service, managed scan findings are automatically available in the Security Command Center Vulnerabilitiespage and related reports. For information about how to enable Web Security Scanner managed scans, see Configure Security Command Center services .

Managed scans support only applications that use the default port, which is 80 for HTTP connections and 443 for HTTPS connections. If your application uses a non-default port, do a custom scan instead.

Custom scans

Web Security Scanner custom scans provide granular information about application vulnerability findings, like outdated libraries, cross-site scripting, or use of mixed content.

You define custom scans at the project level.

Custom scan findings are available in Security Command Center after you complete the guide to set up Web Security Scanner custom scans .

Detectors and compliance

Web Security Scanner supports categories in the OWASP Top Ten , a document that ranks and provides remediation guidance for the top 10 most critical web application security risks, as determined by the Open Web Application Security Project (OWASP). For guidance on mitigating OWASP risks, see OWASP Top 10 mitigation options on Google Cloud .

The compliance mapping is included for reference and is not provided or reviewed by the OWASP Foundation.

This functionality is only intended for you to monitor for compliance controls violations. The mappings are not provided for use as the basis of, or as a substitute for, the audit, certification, or report of compliance of your products or services with any regulatory or industry benchmarks or standards.

For more information, see Web Security Scanner Overview .

Threat detection services

Threat detection services include built-in and integrated services that detect events that might indicate potentially harmful events, such as compromised resources or cyberattacks.

Anomaly Detection

Anomaly Detection is a built-in service that uses behavior signals from outside your system. It displays granular information about security anomalies detected for your service accounts, such as potential leaked credentials. Anomaly Detection is automatically enabled when you activate Security Command Center Standard or Premium tier, and findings are available in the Google Cloud console.

Anomaly Detection findings include the following:

Account has leaked credentials

GitHub notified Security Command Center that the credentials that were used for a commit appear to be the credentials for a Google Cloud Identity and Access Management service account.

The notification includes the service account name and the private key identifier. Google Cloud also sends your designated contact for security and privacy issues a notification by email.

To remediate this issue, take one or more of the following actions:

• Identify the legitimate user of the key.
• Rotate the key.
• Remove the key.
• Investigate any actions that were taken by the key after the key was leaked to ensure that none of the actions were malicious.

 { 
  
 "findings" 
 : 
  
 { 
  
 "access" 
 : 
  
 {}, 
  
 "assetDisplayName" 
 : 
  
 " PROJECT_NAME 
" 
 , 
  
 "assetId" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/assets/ ASSET_ID 
" 
 , 
  
 "canonicalName" 
 : 
  
 "projects/ PROJECT_ID 
/sources/ SOURCE_INSTANCE_ID 
/findings/ FINDING_ID 
" 
 , 
  
 "category" 
 : 
  
 "account_has_leaked_credentials" 
 , 
  
 "contacts" 
 : 
  
 { 
  
 "security" 
 : 
  
 { 
  
 "contacts" 
 : 
  
 [ 
  
 { 
  
 "email" 
 : 
  
 " EMAIL_ADDRESS 
" 
  
 } 
  
 ] 
  
 } 
  
 }, 
  
 "createTime" 
 : 
  
 "2022-08-05T20:59:41.022Z" 
 , 
  
 "database" 
 : 
  
 {}, 
  
 "eventTime" 
 : 
  
 "2022-08-05T20:59:40Z" 
 , 
  
 "exfiltration" 
 : 
  
 {}, 
  
 "findingClass" 
 : 
  
 "THREAT" 
 , 
  
 "findingProviderId" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/firstPartyFindingProviders/cat" 
 , 
  
 "indicator" 
 : 
  
 {}, 
  
 "kubernetes" 
 : 
  
 {}, 
  
 "mitreAttack" 
 : 
  
 {}, 
  
 "mute" 
 : 
  
 "UNDEFINED" 
 , 
  
 "name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/ SOURCE_INSTANCE_ID 
/findings/ FINDING_ID 
" 
 , 
  
 "parent" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/ SOURCE_INSTANCE_ID 
" 
 , 
  
 "parentDisplayName" 
 : 
  
 "Cloud Anomaly Detection" 
 , 
  
 "resourceName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "severity" 
 : 
  
 "CRITICAL" 
 , 
  
 "sourceDisplayName" 
 : 
  
 "Cloud Anomaly Detection" 
 , 
  
 "state" 
 : 
  
 "ACTIVE" 
 , 
  
 "vulnerability" 
 : 
  
 {}, 
  
 "workflowState" 
 : 
  
 "NEW" 
  
 }, 
  
 "resource" 
 : 
  
 { 
  
 "name" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "display_name" 
 : 
  
 " PROJECT_NAME 
" 
 , 
  
 "project_name" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "project_display_name" 
 : 
  
 " PROJECT_NAME 
" 
 , 
  
 "parent_name" 
 : 
  
 "//cloudresourcemanager.googleapis.com/organizations/ ORGANIZATION_ID 
" 
 , 
  
 "parent_display_name" 
 : 
  
 " ORGANIZATION_NAME 
" 
 , 
  
 "type" 
 : 
  
 "google.cloud.resourcemanager.Project" 
 , 
  
 "folders" 
 : 
  
 [] 
  
 }, 
  
 "sourceProperties" 
 : 
  
 { 
  
 "project_identifier" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "compromised_account" 
 : 
  
 " SERVICE_ACCOUNT_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com" 
 , 
  
 "finding_type" 
 : 
  
 "Potential compromise of a resource in your organization." 
 , 
  
 "summary_message" 
 : 
  
 "We have detected leaked Service Account authentication credentials that could be potentially compromised." 
 , 
  
 "action_taken" 
 : 
  
 "Notification sent" 
 , 
  
 "private_key_identifier" 
 : 
  
 " SERVICE_ACCOUNT_KEY_ID 
" 
 , 
  
 "url" 
 : 
  
 "https://github.com/ KEY_FILE_PATH 
/ KEY_FILE_NAME 
.json" 
  
 } 
 } 
  

Container Threat Detection

Container Threat Detection can detect the most common container runtime attacks and alert you in Security Command Center and optionally in Cloud Logging. Container Threat Detection includes several detection capabilities, an analysis tool, and an API.

Container Threat Detection detection instrumentation collects low-level behavior in the guest kernel and performs natural language processing on code to detect the following events:

• Added Binary Executed
• Added Library Loaded
• Command and Control: Steganography Tool Detected ( Preview )
• Credential Access: Find Google Cloud Credentials
• Credential Access: GPG Key Reconnaissance
• Credential Access: Search Private Keys or Passwords
• Defense Evasion: Base64 ELF File Command Line
• Defense Evasion: Base64 Encoded Python Script Executed
• Defense Evasion: Base64 Encoded Shell Script Executed
• Defense Evasion: Launch Code Compiler Tool In Container ( Preview )
• Execution: Added Malicious Binary Executed
• Execution: Added Malicious Library Loaded
• Execution: Built in Malicious Binary Executed
• Execution: Container Escape
• Execution: Fileless Execution in /memfd:
• Execution: Ingress Nightmare Vulnerability Execution ( Preview )
• Execution: Kubernetes Attack Tool Execution
• Execution: Local Reconnaissance Tool Execution
• Execution: Malicious Python executed
• Execution: Modified Malicious Binary Executed
• Execution: Modified Malicious Library Loaded
• Execution: Netcat Remote Code Execution In Container
• Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)
• Execution: Possible Remote Command Execution Detected ( Preview )
• Execution: Program Run with Disallowed HTTP Proxy Env
• Execution: Socat Reverse Shell Detected
• Execution: Suspicious OpenSSL Shared Object Loaded
• Exfiltration: Launch Remote File Copy Tools in Container
• Impact: Detect Malicious Cmdlines ( Preview )
• Impact: Remove Bulk Data From Disk
• Impact: Suspicious crypto mining activity using the Stratum Protocol
• Malicious Script Executed
• Malicious URL Observed
• Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)
• Privilege Escalation: Fileless Execution in /dev/shm
• Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
• Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
• Reverse Shell
• Unexpected Child Shell

Learn more about Container Threat Detection .

Event Threat Detection

Event Threat Detection uses log data from inside your systems. It watches Cloud Logging stream for projects, and consumes logs as they become available. When a threat is detected, Event Threat Detection writes a finding to Security Command Center and to a Cloud Logging project. Event Threat Detection is automatically enabled when you activate the Security Command Center Premium tier and findings are available in the Google Cloud console.

The following table lists examples of Event Threat Detection findings.

Learn more about Event Threat Detection .

Google Cloud Armor

Cloud Armor helps protect your application by providing Layer 7 filtering. Cloud Armor scrubs incoming requests for common web attacks or other Layer 7 attributes to potentially block traffic before it reaches your load-balanced backend services or backend buckets.

Cloud Armor exports two findings to Security Command Center:

• Allowed Traffic Spike

• Increasing Deny Ratio

Virtual Machine Threat Detection

Virtual Machine Threat Detection is a built-in service of Security Command Center. This service scans virtual machines to detect potentially malicious applications, such as cryptocurrency mining software, kernel-mode rootkits, and malware running in compromised cloud environments.

VM Threat Detection is part of the Security Command Center threat detection suite and is designed to complement the existing capabilities of Event Threat Detection and Container Threat Detection .

For more information about VM Threat Detection, see VM Threat Detection overview .

VM Threat Detection threat findings

VM Threat Detection can generate the following threat findings.

Cryptocurrency mining threat findings

VM Threat Detection detects the following finding categories through hash matching or YARA rules.

Kernel-mode rootkit threat findings

VM Threat Detection analyzes kernel integrity at run time to detect common evasion techniques that are used by malware.

The KERNEL_MEMORY_TAMPERING module detects threats by doing a hash comparison on the kernel code and kernel read-only data memory of a virtual machine.

The KERNEL_INTEGRITY_TAMPERING module detects threats by checking the integrity of important kernel data structures.

Errors

Error detectors can help you detect errors in your configuration that prevent security sources from generating findings. Error findings are generated by the Security Command Center security source and have the finding class SCC errors .

Inadvertent actions

The following finding categories represent errors possibly caused by unintentional actions.

For more information, see Security Command Center errors .

What's next

• Learn about Security Command Center in the Security Command Center overview .
• Learn how to add new security sources by configuring Security Command Center services .