GCP Security Command Center - Detect projects with API Keys present

GoogleCloudSCC
 | where tostring(Findings.state) == "ACTIVE"
 | extend FindingCategory = tostring(Findings.category)
 | where FindingCategory == "API_KEY_EXISTS"
 | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
 | extend ResourceName = tostring(FindingsJson.resourceName)
 | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
 | extend ProjectName = tostring(FindingsResourceJson.displayName)
 | extend Severity = tostring(FindingsJson.severity),
          FindingName = tostring(FindingsJson.name),
          ExternalUri = tostring(FindingsJson.externalUri),
          Description = tostring(FindingsJson.description)
 // Produce one row per project with an API key finding
 | summarize TimeGenerated = max(TimeGenerated),
             FindingsCount = count(),
             ExternalUri = any(ExternalUri),
             Description = any(Description)
   by ProjectId, ProjectName, Severity, ResourceName
 | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description

triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyExists.yaml
triggerThreshold: 0
id: 395f3ced-3923-4b83-b05d-8d077fd48c1e
kind: Scheduled
relevantTechniques:
- T1552
version: 1.0.0
tactics:
- CredentialAccess
queryPeriod: 1h
queryFrequency: 1h
alertDetailsOverride:
  alertDescriptionFormat: Project {{ProjectName}} ({{ProjectId}}) has {{FindingsCount}} API key finding(s). Review API keys and consider rotating or removing keys and using IAM-based authentication.
  alertDisplayNameFormat: GCP project {{ProjectName}} has API key(s) present
severity: Medium
name: GCP Security Command Center - Detect projects with API Keys present
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: ProjectName
  - identifier: AppId
    columnName: ProjectId
requiredDataConnectors:
- connectorId: GoogleSCCDefinition
  dataTypes:
  - GoogleCloudSCC
tags:
- CIS GCP Foundation 3.0 1.12
- NIST 800-53 R5 PL-8, SA-8
- PCI-DSS v4.0 2.2.2, 6.2.1
- ISO-27001 v2022 A.8.27
- Cloud Controls Matrix 4 DSP-07
- NIST Cybersecurity Framework 1.0 PR-IP-2
- CIS Controls 8.0 16.10
description: |
  Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings.
  Projects with API Keys may expose credentials that enable unauthorized access if keys are leaked.
status: Available
query: |
  GoogleCloudSCC
   | where tostring(Findings.state) == "ACTIVE"
   | extend FindingCategory = tostring(Findings.category)
   | where FindingCategory == "API_KEY_EXISTS"
   | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
   | extend ResourceName = tostring(FindingsJson.resourceName)
   | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
   | extend ProjectName = tostring(FindingsResourceJson.displayName)
   | extend Severity = tostring(FindingsJson.severity),
            FindingName = tostring(FindingsJson.name),
            ExternalUri = tostring(FindingsJson.externalUri),
            Description = tostring(FindingsJson.description)
   // Produce one row per project with an API key finding
   | summarize TimeGenerated = max(TimeGenerated),
               FindingsCount = count(),
               ExternalUri = any(ExternalUri),
               Description = any(Description)
     by ProjectId, ProjectName, Severity, ResourceName
   | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description
customDetails:
  ProjectId: ProjectId
  ProjectName: ProjectName
  FindingsCount: FindingsCount
  SampleDescription: Description
  SampleExternalUri: ExternalUri

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/395f3ced-3923-4b83-b05d-8d077fd48c1e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/395f3ced-3923-4b83-b05d-8d077fd48c1e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Project {{ProjectName}} ({{ProjectId}}) has {{FindingsCount}} API key finding(s). Review API keys and consider rotating or removing keys and using IAM-based authentication.",
          "alertDisplayNameFormat": "GCP project {{ProjectName}} has API key(s) present"
        },
        "alertRuleTemplateName": "395f3ced-3923-4b83-b05d-8d077fd48c1e",
        "customDetails": {
          "FindingsCount": "FindingsCount",
          "ProjectId": "ProjectId",
          "ProjectName": "ProjectName",
          "SampleDescription": "Description",
          "SampleExternalUri": "ExternalUri"
        },
        "description": "Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings.\nProjects with API Keys may expose credentials that enable unauthorized access if keys are leaked.\n",
        "displayName": "GCP Security Command Center - Detect projects with API Keys present",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectName",
                "identifier": "Name"
              },
              {
                "columnName": "ProjectId",
                "identifier": "AppId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyExists.yaml",
        "query": "GoogleCloudSCC\n | where tostring(Findings.state) == \"ACTIVE\"\n | extend FindingCategory = tostring(Findings.category)\n | where FindingCategory == \"API_KEY_EXISTS\"\n | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)\n | extend ResourceName = tostring(FindingsJson.resourceName)\n | extend ProjectId = extract(@\"projects/([^/]+)\", 1, ResourceName)\n | extend ProjectName = tostring(FindingsResourceJson.displayName)\n | extend Severity = tostring(FindingsJson.severity),\n          FindingName = tostring(FindingsJson.name),\n          ExternalUri = tostring(FindingsJson.externalUri),\n          Description = tostring(FindingsJson.description)\n // Produce one row per project with an API key finding\n | summarize TimeGenerated = max(TimeGenerated),\n             FindingsCount = count(),\n             ExternalUri = any(ExternalUri),\n             Description = any(Description)\n   by ProjectId, ProjectName, Severity, ResourceName\n | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "tags": [
          "CIS GCP Foundation 3.0 1.12",
          "NIST 800-53 R5 PL-8, SA-8",
          "PCI-DSS v4.0 2.2.2, 6.2.1",
          "ISO-27001 v2022 A.8.27",
          "Cloud Controls Matrix 4 DSP-07",
          "NIST Cybersecurity Framework 1.0 PR-IP-2",
          "CIS Controls 8.0 16.10"
        ],
        "techniques": [
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}