GCP Unauthorized User Activity
Dash が新機能を発表!インシデントマネジメント、Continuous Profiler など多数の機能が追加されました! Dash イベントで発表された新機能!
<  Back to rules search

GCP Unauthorized User Activity

Classification:

compliance

Set up the gcp integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Goal

Detect when unauthorized activity by a user is detected in GCP

Strategy

Monitor GCP logs and detect when a user account makes an API request and the request returns the status code equal to 7 within the log attribute @data.protoPayload.status.code. The status code 7 indicates the user account did not have permission to make the API call.

Triage & Response

  1. Determine the user who made the unauthorized calls.
  2. Determine if there is a misconfiguration in IAM permissions or whether an attacker has compromised the user account.