GCP Security Command Center - Detect OpenUnrestricted API Keys

GoogleCloudSCC
 | where tostring(Findings.state) == "ACTIVE"
 | extend FindingCategory = tostring(Findings.category)
 | where FindingCategory == "API_KEY_APIS_UNRESTRICTED"
 | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
 | extend ResourceName = tostring(FindingsJson.resourceName)
 | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
 | extend ProjectName = tostring(FindingsResourceJson.displayName)
 | extend Severity = tostring(FindingsJson.severity),
          FindingName = tostring(FindingsJson.name),
          ExternalUri = tostring(FindingsJson.externalUri),
          Description = tostring(FindingsJson.description)
 // produce one row per project that has unrestricted API key findings
 | summarize TimeGenerated = max(TimeGenerated),
             FindingsCount = count(),
             ExternalUri = any(ExternalUri),
             Description = any(Description)
   by ProjectId, ProjectName, Severity, ResourceName
 | project TimeGenerated, ProjectId, ProjectName, ResourceName, Severity, ExternalUri, Description

requiredDataConnectors:
- dataTypes:
  - GoogleCloudSCC
  connectorId: GoogleSCCDefinition
tags:
- CIS GCP Foundation 3.0 1.14
- NIST 800-53 R5 PL-8, SA-8
- PCI-DSS v4.0 2.2.2, 6.2.1
- ISO-27001 v2022 A.8.27
- Cloud Controls Matrix 4 DSP-07
- NIST Cybersecurity Framework 1.0 PR-IP-2
- CIS Controls 8.0 16.10
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: Project {{ProjectName}} ({{ProjectId}}) has {{ResourceName}} with unrestricted API keys (API_KEY_APIS_UNRESTRICTED). Review API key restrictions, rotate or remove keys as appropriate, and apply API restrictions to keys.
  alertDisplayNameFormat: GCP project {{ProjectName}} has unrestricted API key(s)
customDetails:
  ExternalUri: ExternalUri
  ResourceName: ResourceName
  Description: Description
queryFrequency: 1h
query: |
  GoogleCloudSCC
   | where tostring(Findings.state) == "ACTIVE"
   | extend FindingCategory = tostring(Findings.category)
   | where FindingCategory == "API_KEY_APIS_UNRESTRICTED"
   | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)
   | extend ResourceName = tostring(FindingsJson.resourceName)
   | extend ProjectId = extract(@"projects/([^/]+)", 1, ResourceName)
   | extend ProjectName = tostring(FindingsResourceJson.displayName)
   | extend Severity = tostring(FindingsJson.severity),
            FindingName = tostring(FindingsJson.name),
            ExternalUri = tostring(FindingsJson.externalUri),
            Description = tostring(FindingsJson.description)
   // produce one row per project that has unrestricted API key findings
   | summarize TimeGenerated = max(TimeGenerated),
               FindingsCount = count(),
               ExternalUri = any(ExternalUri),
               Description = any(Description)
     by ProjectId, ProjectName, Severity, ResourceName
   | project TimeGenerated, ProjectId, ProjectName, ResourceName, Severity, ExternalUri, Description
tactics:
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1190
- T1552
id: d8e30113-373a-4f49-a0ad-1a5d8b95b729
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyApisUnrestricted.yaml
name: GCP Security Command Center - Detect Open/Unrestricted API Keys
queryPeriod: 1h
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: ProjectName
    identifier: Name
  - columnName: ProjectId
    identifier: AppId
  entityType: CloudApplication
kind: Scheduled
description: |
  Detects Google Cloud projects that have API keys with unrestricted API access using Security Command Center API_KEY_APIS_UNRESTRICTED findings.
  These findings indicate API keys that are not restricted to specific APIs and may allow broader access than intended.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d8e30113-373a-4f49-a0ad-1a5d8b95b729')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d8e30113-373a-4f49-a0ad-1a5d8b95b729')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Project {{ProjectName}} ({{ProjectId}}) has {{ResourceName}} with unrestricted API keys (API_KEY_APIS_UNRESTRICTED). Review API key restrictions, rotate or remove keys as appropriate, and apply API restrictions to keys.",
          "alertDisplayNameFormat": "GCP project {{ProjectName}} has unrestricted API key(s)"
        },
        "alertRuleTemplateName": "d8e30113-373a-4f49-a0ad-1a5d8b95b729",
        "customDetails": {
          "Description": "Description",
          "ExternalUri": "ExternalUri",
          "ResourceName": "ResourceName"
        },
        "description": "Detects Google Cloud projects that have API keys with unrestricted API access using Security Command Center API_KEY_APIS_UNRESTRICTED findings.\nThese findings indicate API keys that are not restricted to specific APIs and may allow broader access than intended.\n",
        "displayName": "GCP Security Command Center - Detect Open/Unrestricted API Keys",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectName",
                "identifier": "Name"
              },
              {
                "columnName": "ProjectId",
                "identifier": "AppId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPAPIKeyApisUnrestricted.yaml",
        "query": "GoogleCloudSCC\n | where tostring(Findings.state) == \"ACTIVE\"\n | extend FindingCategory = tostring(Findings.category)\n | where FindingCategory == \"API_KEY_APIS_UNRESTRICTED\"\n | extend FindingsJson = parse_json(Findings), FindingsResourceJson = parse_json(FindingsResource)\n | extend ResourceName = tostring(FindingsJson.resourceName)\n | extend ProjectId = extract(@\"projects/([^/]+)\", 1, ResourceName)\n | extend ProjectName = tostring(FindingsResourceJson.displayName)\n | extend Severity = tostring(FindingsJson.severity),\n          FindingName = tostring(FindingsJson.name),\n          ExternalUri = tostring(FindingsJson.externalUri),\n          Description = tostring(FindingsJson.description)\n // produce one row per project that has unrestricted API key findings\n | summarize TimeGenerated = max(TimeGenerated),\n             FindingsCount = count(),\n             ExternalUri = any(ExternalUri),\n             Description = any(Description)\n   by ProjectId, ProjectName, Severity, ResourceName\n | project TimeGenerated, ProjectId, ProjectName, ResourceName, Severity, ExternalUri, Description\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "tags": [
          "CIS GCP Foundation 3.0 1.14",
          "NIST 800-53 R5 PL-8, SA-8",
          "PCI-DSS v4.0 2.2.2, 6.2.1",
          "ISO-27001 v2022 A.8.27",
          "Cloud Controls Matrix 4 DSP-07",
          "NIST Cybersecurity Framework 1.0 PR-IP-2",
          "CIS Controls 8.0 16.10"
        ],
        "techniques": [
          "T1190",
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}