Anomalous number of Google Cloud Storage Objects Accessed

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.


Detect when a Google Cloud identity accesses a number of Google Cloud Storage objects that they do not usually access.


Monitor Google Cloud Audit logs to identify when a Google Cloud identity makes an anomalous number of storage.objects.get calls to a unique number of Google Cloud Storage buckets (bucket_name).

Triage and response

  1. Determine if the user: {{}} should be accessing the storage buckets.
    • Here is a list of buckets that were accessed (up to 10): {{bucket_name}}
  2. If the action is legitimate, consider including the user in a suppression list. See this article on Best practices for creating detection rules with Datadog Cloud SIEM for more information.
  3. Otherwise, use the Cloud SIEM - User Investigation dashboard to see if the User: {{}} has taken other actions.
  4. If the results of the triage indicate that an attacker has taken the action, begin your company’s incident response process and investigate.