Dokumen ini memberikan ringkasan set aturan dalam kategori Ancaman Chrome Enterprise, sumber data yang diperlukan, dan konfigurasi yang dapat Anda gunakan untuk menyesuaikan notifikasi yang dihasilkan oleh setiap set aturan.
Set aturan dalam kategori Ancaman Chrome Enterprise Premium membantu mengidentifikasi ancaman di lingkunganGoogle Cloud menggunakan log Pengelolaan Chrome Enterprise Premium. Kategori ini
mencakup kumpulan aturan berikut:
Ancaman Ekstensi Chrome: Mendeteksi aktivitas terkait ekstensi Chrome yang dapat mengindikasikan perilaku berbahaya atau mencurigakan.
Ancaman Browser Chrome: Mendeteksi perilaku mencurigakan dalam browser Chrome yang mungkin mengindikasikan adanya kompromi. Hal ini mencakup, tetapi tidak terbatas pada, pengiriman payload, upaya eksfiltrasi, dan pengumpulan sandi.
Perangkat dan jenis log yang didukung
Set aturan dalam kategori Ancaman Chrome Enterprise Premium memerlukan log dari sumber data Google Security Operations berikut:
Log Pengelolaan Chrome (CHROME_MANAGEMENT)
Untuk mengirimkan log ini ke Google SecOps, ikuti langkah-langkah di
Mengumpulkan log Google Chrome.
Hubungi perwakilan Google SecOps Anda jika Anda perlu mengumpulkan log ini menggunakan mekanisme yang berbeda.
Menyesuaikan pemberitahuan yang ditampilkan oleh set aturan
Anda dapat mengurangi jumlah deteksi yang dihasilkan oleh aturan atau kumpulan aturan menggunakan
pengecualian aturan.
Pengecualian aturan menentukan kriteria yang digunakan untuk mengecualikan peristiwa agar tidak dievaluasi oleh set aturan, atau oleh aturan tertentu dalam set aturan. Buat satu atau
beberapa pengecualian aturan untuk membantu mengurangi volume deteksi. Lihat
Mengonfigurasi pengecualian aturan untuk mengetahui informasi selengkapnya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eThe Chrome Enterprise Threats category in Google SecOps identifies potential threats within the Google Cloud environment using Chrome Enterprise Management logs.\u003c/p\u003e\n"],["\u003cp\u003eThis category includes rule sets like Chrome Extension Threats, which detect malicious or suspicious behavior related to Chrome extensions, and Chrome Browser Threats, which detect suspicious browser activity indicative of compromise.\u003c/p\u003e\n"],["\u003cp\u003eThe rule sets in this category require Chrome Management Logs (\u003ccode\u003eCHROME_MANAGEMENT\u003c/code\u003e) from Google Security Operations data sources.\u003c/p\u003e\n"],["\u003cp\u003eYou can tune alerts generated by these rule sets and reduce the number of detections through the use of rule exclusions, which filter out specific events from being evaluated.\u003c/p\u003e\n"]]],[],null,["# Overview of Chrome Enterprise Premium Threats Category\n======================================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document provides an overview of the rule sets within the Chrome Enterprise\nThreats category, the required data sources, and configuration you can use to\ntune the alerts generated by each rule set.\nRule sets in the Chrome Enterprise Premium Threats category help identify threats in the\nGoogle Cloud environment using Chrome Enterprise Premium Management logs. This category\nincludes the following rule sets:\n\n- **Chrome Extension Threats**: Detects activities related to Chrome extensions\n that could indicate malicious or suspicious behavior.\n\n- **Chrome Browser Threats**: Detects suspicious behavior within Chrome browser that\n may indicate a compromise. This includes, but is not limited to, payload\n deliveries, exfiltration attempts, and password harvesting.\n\nSupported devices and log types\n-------------------------------\n\nThe rule sets in the Chrome Enterprise Premium Threats category require logs from the\nfollowing Google Security Operations data sources:\n\n- Chrome Management Logs (`CHROME_MANAGEMENT`)\n\nTo feed these logs to Google SecOps, follow the steps in\n[Collect Google Chrome logs](/chronicle/docs/ingestion/default-parsers/collect-chrome-management).\nContact your Google SecOps representative if you need to collect\nthese logs using a different mechanism.\n\nFor a list of all Google SecOps supported data sources, see\n[Supported log types and default parsers](/chronicle/docs/ingestion/parser-list/supported-default-parsers).\n\nTune alerts returned by rule sets\n---------------------------------\n\nYou can reduce the number of detections a rule or rule set generates using\n[rule exclusions](/chronicle/docs/detection/rule-exclusions).\n\nA rule exclusion defines the criteria used to exclude an event from being\nevaluated by the rule set, or by specific rules in the rule set. Create one or\nmore rule exclusions to help reduce the volume of detections. See\n[Configure rule exclusions](/chronicle/docs/detection/rule-exclusions) for more\ninformation.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
