Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when Google Security Command Center raises an active threat finding.

Strategy

Google Security Command Center helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities and threats; and helping you mitigate and remediate risks.

This detection rule filters for threat findings which have not been muted. Findings in the Threat class identify a potential active attack or other unwanted or malicious activity.

Triage and response

1. Investigate the finding to determine if it is malicious or benign.
2. If the finding is deemed malicious, follow the investigation and remediation guidance provided by Google and also any internal incident response processes.
3. If the finding is a false positive, you can reduce false positives by:
   • Muting findings in Security Command Center
   • Disabling detectors
   • Adding assets to allowlists