GCP Security Command Center - Detect OpenUnrestricted API Keys

Back


Id	d8e30113-373a-4f49-a0ad-1a5d8b95b729
Rulename	GCP Security Command Center - Detect Open/Unrestricted API Keys
Description	Detects Google Cloud projects that have API keys with unrestricted API access using Security Command Center API_KEY_APIS_UNRESTRICTED findings. These findings indicate API keys that are not restricted to specific APIs and may allow broader access than intended.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1190 T1552
Required data connectors	GoogleSCCDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPAPIKeyApisUnrestricted.yaml
Version	1.0.0
Arm template	d8e30113-373a-4f49-a0ad-1a5d8b95b729.json

KQL

GoogleCloudSCC
 | where tostring(Findings.state) == "ACTIVE"
 | extend FindingCategory = tostring(Findings.category)
 | where FindingCategory == "API_KEY_APIS_UNRESTRICTED"
 | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
 | extend ResourceName = tostring(FindingsJson.resourceName)
 | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
 | extend ProjectName = tostring(FindingsResourceJson.displayName)
 | extend Severity = tostring(FindingsJson.severity),
          FindingName = tostring(FindingsJson.name),
          ExternalUri = tostring(FindingsJson.externalUri),
          Description = tostring(FindingsJson.description)
 // produce one row per project that has unrestricted API key findings
 | summarize TimeGenerated = max(TimeGenerated),
             FindingsCount = count(),
             ExternalUri = any(ExternalUri),
             Description = any(Description)
   by ProjectId, ProjectName, Severity, ResourceName
 | project TimeGenerated, ProjectId, ProjectName, ResourceName, Severity, ExternalUri, Description

YAML

description: |
  Detects Google Cloud projects that have API keys with unrestricted API access using Security Command Center API_KEY_APIS_UNRESTRICTED findings.
  These findings indicate API keys that are not restricted to specific APIs and may allow broader access than intended.  
version: 1.0.0
triggerThreshold: 0
tactics:
- InitialAccess
- CredentialAccess
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPAPIKeyApisUnrestricted.yaml
triggerOperator: gt
status: Available
alertDetailsOverride:
  alertDisplayNameFormat: GCP project {{ProjectName}} has unrestricted API key(s)
  alertDescriptionFormat: Project {{ProjectName}} ({{ProjectId}}) has {{ResourceName}} with unrestricted API keys (API_KEY_APIS_UNRESTRICTED). Review API key restrictions, rotate or remove keys as appropriate, and apply API restrictions to keys.
id: d8e30113-373a-4f49-a0ad-1a5d8b95b729
name: GCP Security Command Center - Detect Open/Unrestricted API Keys
queryFrequency: 1h
severity: Medium
customDetails:
  ExternalUri: ExternalUri
  Description: Description
  ResourceName: ResourceName
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: ProjectName
    identifier: Name
  - columnName: ProjectId
    identifier: AppId
  entityType: CloudApplication
relevantTechniques:
- T1190
- T1552
query: |
  GoogleCloudSCC
   | where tostring(Findings.state) == "ACTIVE"
   | extend FindingCategory = tostring(Findings.category)
   | where FindingCategory == "API_KEY_APIS_UNRESTRICTED"
   | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
   | extend ResourceName = tostring(FindingsJson.resourceName)
   | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
   | extend ProjectName = tostring(FindingsResourceJson.displayName)
   | extend Severity = tostring(FindingsJson.severity),
            FindingName = tostring(FindingsJson.name),
            ExternalUri = tostring(FindingsJson.externalUri),
            Description = tostring(FindingsJson.description)
   // produce one row per project that has unrestricted API key findings
   | summarize TimeGenerated = max(TimeGenerated),
               FindingsCount = count(),
               ExternalUri = any(ExternalUri),
               Description = any(Description)
     by ProjectId, ProjectName, Severity, ResourceName
   | project TimeGenerated, ProjectId, ProjectName, ResourceName, Severity, ExternalUri, Description  
tags:
- CIS GCP Foundation 3.0 1.14
- NIST 800-53 R5 PL-8, SA-8
- PCI-DSS v4.0 2.2.2, 6.2.1
- ISO-27001 v2022 A.8.27
- Cloud Controls Matrix 4 DSP-07
- NIST Cybersecurity Framework 1.0 PR-IP-2
- CIS Controls 8.0 16.10
requiredDataConnectors:
- dataTypes:
  - GoogleCloudSCC
  connectorId: GoogleSCCDefinition

ARM