GCP Security Command Center - Detect Resources with Logging Disabled

Back


Id	d1fe8d30-4852-463a-b6ee-3b459788b75d
Rulename	GCP Security Command Center - Detect Resources with Logging Disabled
Description	Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	GoogleSCCDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yaml
Version	1.0.0
Arm template	d1fe8d30-4852-463a-b6ee-3b459788b75d.json

KQL

GoogleCloudSCC
| where tostring(Findings.state) == "ACTIVE"
| extend FindingCategory = tostring(Findings.category)
| where FindingCategory in ("BUCKET_LOGGING_DISABLED", "FIREWALL_RULE_LOGGING_DISABLED", "DNS_LOGGING_DISABLED")
| extend FindingsJson = parse_json(Findings)
| extend Resource = tostring(FindingsJson.resourceName),
         ExternalUri = tostring(FindingsJson.externalUri),
         Description = tostring(FindingsJson.description),
         Severity = tostring(FindingsJson.severity),
         ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
         ResourceType = extract(@"//([a-z0-9_.-]+)/", 1, tostring(FindingsJson.resourceName)),
         SourceProps = parse_json(tostring(FindingsJson.sourceProperties))
// Normalize display-friendly resource id
| extend ResourceName = case(
    Resource contains "firewalls/", extract(@"firewalls/([^/]+)", 1, Resource),
    Resource contains "storage.googleapis.com/", extract(@'storage.googleapis.com/([^/\"]+)', 1, Resource),
    Resource contains "networks/", extract(@"networks/([^/]+)", 1, Resource),
    Resource
  )
| project TimeGenerated, ProjectName, ResourceType, ResourceName, Resource, FindingCategory, Severity, ExternalUri, Description

YAML

queryPeriod: 1h
requiredDataConnectors:
- connectorId: GoogleSCCDefinition
  dataTypes:
  - GoogleCloudSCC
severity: Medium
triggerOperator: gt
customDetails:
  Description: Description
  Severity: Severity
  ExternalUri: ExternalUri
  FindingCategory: FindingCategory
  ResourceType: ResourceType
  ProjectName: ProjectName
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ResourceName
  entityType: CloudApplication
tags:
- Logging
- GCP
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  GoogleCloudSCC
  | where tostring(Findings.state) == "ACTIVE"
  | extend FindingCategory = tostring(Findings.category)
  | where FindingCategory in ("BUCKET_LOGGING_DISABLED", "FIREWALL_RULE_LOGGING_DISABLED", "DNS_LOGGING_DISABLED")
  | extend FindingsJson = parse_json(Findings)
  | extend Resource = tostring(FindingsJson.resourceName),
           ExternalUri = tostring(FindingsJson.externalUri),
           Description = tostring(FindingsJson.description),
           Severity = tostring(FindingsJson.severity),
           ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
           ResourceType = extract(@"//([a-z0-9_.-]+)/", 1, tostring(FindingsJson.resourceName)),
           SourceProps = parse_json(tostring(FindingsJson.sourceProperties))
  // Normalize display-friendly resource id
  | extend ResourceName = case(
      Resource contains "firewalls/", extract(@"firewalls/([^/]+)", 1, Resource),
      Resource contains "storage.googleapis.com/", extract(@'storage.googleapis.com/([^/\"]+)', 1, Resource),
      Resource contains "networks/", extract(@"networks/([^/]+)", 1, Resource),
      Resource
    )
  | project TimeGenerated, ProjectName, ResourceType, ResourceName, Resource, FindingCategory, Severity, ExternalUri, Description  
id: d1fe8d30-4852-463a-b6ee-3b459788b75d
name: GCP Security Command Center - Detect Resources with Logging Disabled
status: Available
version: 1.0.0
description: |
    Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings.
alertDetailsOverride:
  alertDescriptionFormat: 'Resource {{ResourceName}} in project {{ProjectName}} (type: {{ResourceType}}) has logging disabled.'
  alertDisplayNameFormat: 'GCP resources with logging disabled: {{ProjectName}} ({{ResourceType}})'
kind: Scheduled
queryFrequency: 1h

ARM