GCP Security Command Center - Detect projects with API Keys present

Back


Id	395f3ced-3923-4b83-b05d-8d077fd48c1e
Rulename	GCP Security Command Center - Detect projects with API Keys present
Description	Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings. Projects with API Keys may expose credentials that enable unauthorized access if keys are leaked.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1552
Required data connectors	GoogleSCCDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyExists.yaml
Version	1.0.0
Arm template	395f3ced-3923-4b83-b05d-8d077fd48c1e.json

KQL

GoogleCloudSCC
 | where tostring(Findings.state) == "ACTIVE"
 | extend FindingCategory = tostring(Findings.category)
 | where FindingCategory == "API_KEY_EXISTS"
 | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
 | extend ResourceName = tostring(FindingsJson.resourceName)
 | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
 | extend ProjectName = tostring(FindingsResourceJson.displayName)
 | extend Severity = tostring(FindingsJson.severity),
          FindingName = tostring(FindingsJson.name),
          ExternalUri = tostring(FindingsJson.externalUri),
          Description = tostring(FindingsJson.description)
 // Produce one row per project with an API key finding
 | summarize TimeGenerated = max(TimeGenerated),
             FindingsCount = count(),
             ExternalUri = any(ExternalUri),
             Description = any(Description)
   by ProjectId, ProjectName, Severity, ResourceName
 | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description

YAML

severity: Medium
tactics:
- CredentialAccess
queryFrequency: 1h
id: 395f3ced-3923-4b83-b05d-8d077fd48c1e
query: |
  GoogleCloudSCC
   | where tostring(Findings.state) == "ACTIVE"
   | extend FindingCategory = tostring(Findings.category)
   | where FindingCategory == "API_KEY_EXISTS"
   | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
   | extend ResourceName = tostring(FindingsJson.resourceName)
   | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
   | extend ProjectName = tostring(FindingsResourceJson.displayName)
   | extend Severity = tostring(FindingsJson.severity),
            FindingName = tostring(FindingsJson.name),
            ExternalUri = tostring(FindingsJson.externalUri),
            Description = tostring(FindingsJson.description)
   // Produce one row per project with an API key finding
   | summarize TimeGenerated = max(TimeGenerated),
               FindingsCount = count(),
               ExternalUri = any(ExternalUri),
               Description = any(Description)
     by ProjectId, ProjectName, Severity, ResourceName
   | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ProjectName
  - identifier: AppId
    columnName: ProjectId
  entityType: CloudApplication
customDetails:
  SampleDescription: Description
  SampleExternalUri: ExternalUri
  ProjectName: ProjectName
  ProjectId: ProjectId
  FindingsCount: FindingsCount
kind: Scheduled
triggerOperator: gt
name: GCP Security Command Center - Detect projects with API Keys present
tags:
- CIS GCP Foundation 3.0 1.12
- NIST 800-53 R5 PL-8, SA-8
- PCI-DSS v4.0 2.2.2, 6.2.1
- ISO-27001 v2022 A.8.27
- Cloud Controls Matrix 4 DSP-07
- NIST Cybersecurity Framework 1.0 PR-IP-2
- CIS Controls 8.0 16.10
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
  - GoogleCloudSCC
  connectorId: GoogleSCCDefinition
description: |
  Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings.
  Projects with API Keys may expose credentials that enable unauthorized access if keys are leaked.
relevantTechniques:
- T1552
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyExists.yaml
triggerThreshold: 0
alertDetailsOverride:
  alertDisplayNameFormat: GCP project {{ProjectName}} has API key(s) present
  alertDescriptionFormat: Project {{ProjectName}} ({{ProjectId}}) has {{FindingsCount}} API key finding(s). Review API keys and consider rotating or removing keys and using IAM-based authentication.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/395f3ced-3923-4b83-b05d-8d077fd48c1e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/395f3ced-3923-4b83-b05d-8d077fd48c1e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Project {{ProjectName}} ({{ProjectId}}) has {{FindingsCount}} API key finding(s). Review API keys and consider rotating or removing keys and using IAM-based authentication.",
          "alertDisplayNameFormat": "GCP project {{ProjectName}} has API key(s) present"
        },
        "alertRuleTemplateName": "395f3ced-3923-4b83-b05d-8d077fd48c1e",
        "customDetails": {
          "FindingsCount": "FindingsCount",
          "ProjectId": "ProjectId",
          "ProjectName": "ProjectName",
          "SampleDescription": "Description",
          "SampleExternalUri": "ExternalUri"
        },
        "description": "Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings.\nProjects with API Keys may expose credentials that enable unauthorized access if keys are leaked.\n",
        "displayName": "GCP Security Command Center - Detect projects with API Keys present",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectName",
                "identifier": "Name"
              },
              {
                "columnName": "ProjectId",
                "identifier": "AppId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyExists.yaml",
        "query": "GoogleCloudSCC\n | where tostring(Findings.state) == \"ACTIVE\"\n | extend FindingCategory = tostring(Findings.category)\n | where FindingCategory == \"API_KEY_EXISTS\"\n | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)\n | extend ResourceName = tostring(FindingsJson.resourceName)\n | extend ProjectId = extract(@\"projects/([^/]+)\", 1, ResourceName)\n | extend ProjectName = tostring(FindingsResourceJson.displayName)\n | extend Severity = tostring(FindingsJson.severity),\n          FindingName = tostring(FindingsJson.name),\n          ExternalUri = tostring(FindingsJson.externalUri),\n          Description = tostring(FindingsJson.description)\n // Produce one row per project with an API key finding\n | summarize TimeGenerated = max(TimeGenerated),\n             FindingsCount = count(),\n             ExternalUri = any(ExternalUri),\n             Description = any(Description)\n   by ProjectId, ProjectName, Severity, ResourceName\n | project TimeGenerated, ProjectId, ProjectName, ResourceName, FindingsCount, Severity, ExternalUri, Description\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "tags": [
          "CIS GCP Foundation 3.0 1.12",
          "NIST 800-53 R5 PL-8, SA-8",
          "PCI-DSS v4.0 2.2.2, 6.2.1",
          "ISO-27001 v2022 A.8.27",
          "Cloud Controls Matrix 4 DSP-07",
          "NIST Cybersecurity Framework 1.0 PR-IP-2",
          "CIS Controls 8.0 16.10"
        ],
        "techniques": [
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}