[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-04-30。"],[[["\u003cp\u003eSecurity profiles are organizational-level resources that define Layer 7 inspection policies for Google Cloud resources, enabling services like intrusion prevention by scanning intercepted traffic.\u003c/p\u003e\n"],["\u003cp\u003eCloud Next Generation Firewall (NGFW) supports threat prevention security profiles, which include default threat signatures such as vulnerability detection, anti-spyware, antivirus, and DNS signatures.\u003c/p\u003e\n"],["\u003cp\u003eSecurity profiles can override default actions for threat severity levels or specific threat signatures, with signature overrides taking precedence over severity overrides.\u003c/p\u003e\n"],["\u003cp\u003eEach security profile is uniquely identified by a URL that includes the organization ID, location (always set to global), and the security profile name, following a specific format.\u003c/p\u003e\n"],["\u003cp\u003eIdentity and Access Management (IAM) roles determine the ability to create, modify, view, or use security profiles, with the Security Profile Admin role being required for creating and modifying them.\u003c/p\u003e\n"]]],[],null,["# Security profile overview\n\nSecurity profiles help you define Layer 7 inspection policy for your\nGoogle Cloud resources. They are generic policy structures\nthat are used by firewall endpoints to scan intercepted traffic to provide\napplication Layer services, such as intrusion detection and prevention.\n\nThis document provides a detailed overview of security profiles and their\ncapabilities.\n\nSpecifications\n--------------\n\n- A security profile is an organizational level resource.\n\n- Cloud Next Generation Firewall supports security profiles of type `threat prevention`.\n\n- Each security profile is uniquely identified by a URL with\n the following elements:\n\n - **Organization ID:** ID of the organization.\n - **Location:** scope of security profile. Location is always set to `global`.\n - **Name:** security profile name in the following format:\n - A string 1-63 characters long\n - Includes only alphanumeric characters or hyphens (-)\n - Must not start with a number\n- To construct a unique URL identifier for a security profile,\n use the following format:\n\n organization/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/securityProfiles/\u003cvar translate=\"no\"\u003eSECURITY_PROFILE_NAME\u003c/var\u003e\n\n For example, a `global` security profile `example-security-profile`\n in organization `2345678432` has the following unique identifier: \n\n organization/2345678432/locations/global/securityProfiles/example-security-profile\n\n- After you create a security profile, you have the option to attach it\n to a [security profile group](/firewall/docs/about-security-profile-groups)\n or to attach it later.\n This security profile group is referenced by the firewall policy of the\n Virtual Private Cloud (VPC) network where you want to enforce Layer 7 inspection.\n\n- Each security profile must have an associated project ID. The associated\n project is used for quotas and access restrictions on security profile\n resources. If you authenticate your service account by using the\n [`gcloud auth activate-service-account` command](/sdk/gcloud/reference/auth/activate-service-account),\n you can associate your service account with the security profile.\n To learn more about how to create a security profile,\n see [Create and manage security profiles](/firewall/docs/configure-security-profiles#create-security-profile).\n\nThreat prevention security profile\n----------------------------------\n\nCloud NGFW uses threat prevention security profiles to provide\n[intrusion detection and prevention service](/firewall/docs/about-intrusion-prevention).\n\nWhen you create a security profile of type `threat-prevention`, the following\n[default threat signatures](/firewall/docs/about-threats#default_signature_set)\nwith default severity and associated actions are added to the profile:\n\n- Vulnerability detection signatures\n- Anti-spyware signatures\n- Antivirus signatures\n- DNS signatures\n\nYou have the option to add severity overrides to your security profiles. Each\ndefault signature has a [threat severity level](/firewall/docs/about-threats#threat-severity-level).\nThe severity level indicates the risk of the detected threat. Each severity\nlevel also has an associated default action. The default action specifies the\nmeasures Cloud NGFW takes to handle threats with a specific\nseverity level. You can use security profiles to override the default action\nfor a severity level.\n\nThe following actions are supported:\n\n- **No override**: performs the default action associated with the threat.\n- **Deny**: logs the threat and drops the packet.\n- **Alert**: logs the threat and allows the session.\n- **Allow**: ignores the threat, if detected.\n\nWhen you create a security profile, the default override action for all\nseverity levels is set to `No override`.\n\nYou can also add signature overrides to your security profiles. Each threat\nsignature has an associated default action. You can use security profiles to\noverride the default actions of the threat signatures by using the preceding\nactions. Signature overrides take precedence over severity overrides.\n| **Note:** If you override the default threat signature action or modify the default severity level action in a security profile, it might take up to 15 minutes for these changes to take effect.\n\nTo learn more about how to configure threat prevention, see\n[Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention).\n\nIdentity and Access Management roles\n------------------------------------\n\nIdentity and Access Management (IAM) roles govern the following security profiles actions:\n\n- Creating a security profile in an organization\n- Modifying or deleting a security profile\n- Viewing details of a security profile\n- Viewing a list of security profiles in an organization\n- Using a security profile in a security profile group\n\nThe following table describes the roles that are necessary for each step.\n\nQuotas\n------\n\nTo view quotas associated with security profiles, see [Quotas and limits](/firewall/docs/quotas).\n\nPricing\n-------\n\nPricing for security profiles is described in [Cloud NGFW pricing](/firewall/pricing).\n\nWhat's next\n-----------\n\n- [Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention)\n- [Create and manage security profiles](/firewall/docs/configure-security-profiles)"]]
