GCP Security Command Center - Detect Resources with Logging Disabled

Back


Id	d1fe8d30-4852-463a-b6ee-3b459788b75d
Rulename	GCP Security Command Center - Detect Resources with Logging Disabled
Description	Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	GoogleSCCDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yaml
Version	1.0.0
Arm template	d1fe8d30-4852-463a-b6ee-3b459788b75d.json

KQL

GoogleCloudSCC
| where tostring(Findings.state) == "ACTIVE"
| extend FindingCategory = tostring(Findings.category)
| where FindingCategory in ("BUCKET_LOGGING_DISABLED", "FIREWALL_RULE_LOGGING_DISABLED", "DNS_LOGGING_DISABLED")
| extend FindingsJson = parse_json(Findings)
| extend Resource = tostring(FindingsJson.resourceName),
         ExternalUri = tostring(FindingsJson.externalUri),
         Description = tostring(FindingsJson.description),
         Severity = tostring(FindingsJson.severity),
         ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
         ResourceType = extract(@"//([a-z0-9_.-]+)/", 1, tostring(FindingsJson.resourceName)),
         SourceProps = parse_json(tostring(FindingsJson.sourceProperties))
// Normalize display-friendly resource id
| extend ResourceName = case(
    Resource contains "firewalls/", extract(@"firewalls/([^/]+)", 1, Resource),
    Resource contains "storage.googleapis.com/", extract(@'storage.googleapis.com/([^/\"]+)', 1, Resource),
    Resource contains "networks/", extract(@"networks/([^/]+)", 1, Resource),
    Resource
  )
| project TimeGenerated, ProjectName, ResourceType, ResourceName, Resource, FindingCategory, Severity, ExternalUri, Description

YAML

alertDetailsOverride:
  alertDescriptionFormat: 'Resource {{ResourceName}} in project {{ProjectName}} (type: {{ResourceType}}) has logging disabled.'
  alertDisplayNameFormat: 'GCP resources with logging disabled: {{ProjectName}} ({{ResourceType}})'
kind: Scheduled
severity: Medium
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- DefenseEvasion
status: Available
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: ResourceName
    identifier: Name
  entityType: CloudApplication
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yaml
query: |
  GoogleCloudSCC
  | where tostring(Findings.state) == "ACTIVE"
  | extend FindingCategory = tostring(Findings.category)
  | where FindingCategory in ("BUCKET_LOGGING_DISABLED", "FIREWALL_RULE_LOGGING_DISABLED", "DNS_LOGGING_DISABLED")
  | extend FindingsJson = parse_json(Findings)
  | extend Resource = tostring(FindingsJson.resourceName),
           ExternalUri = tostring(FindingsJson.externalUri),
           Description = tostring(FindingsJson.description),
           Severity = tostring(FindingsJson.severity),
           ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
           ResourceType = extract(@"//([a-z0-9_.-]+)/", 1, tostring(FindingsJson.resourceName)),
           SourceProps = parse_json(tostring(FindingsJson.sourceProperties))
  // Normalize display-friendly resource id
  | extend ResourceName = case(
      Resource contains "firewalls/", extract(@"firewalls/([^/]+)", 1, Resource),
      Resource contains "storage.googleapis.com/", extract(@'storage.googleapis.com/([^/\"]+)', 1, Resource),
      Resource contains "networks/", extract(@"networks/([^/]+)", 1, Resource),
      Resource
    )
  | project TimeGenerated, ProjectName, ResourceType, ResourceName, Resource, FindingCategory, Severity, ExternalUri, Description  
triggerOperator: gt
tags:
- Logging
- GCP
id: d1fe8d30-4852-463a-b6ee-3b459788b75d
requiredDataConnectors:
- dataTypes:
  - GoogleCloudSCC
  connectorId: GoogleSCCDefinition
relevantTechniques:
- T1562
name: GCP Security Command Center - Detect Resources with Logging Disabled
queryFrequency: 1h
version: 1.0.0
description: |
    Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings.
customDetails:
  ResourceType: ResourceType
  Description: Description
  Severity: Severity
  ExternalUri: ExternalUri
  ProjectName: ProjectName
  FindingCategory: FindingCategory

ARM