Database threat findings

Security Command Center analyzes various logs for potential threats that affect databases. The following log-based detections are available with Event Threat Detection:

Credential Access: CloudDB Failed login from Anonymizing Proxy IP

Exfiltration: Cloud SQL Data Exfiltration

Exfiltration: Cloud SQL Over-Privileged Grant

Exfiltration: Cloud SQL Restore Backup to External Organization

Initial Access: CloudDB Successful login from Anonymizing Proxy IP

Initial Access: Database Superuser Writes to User Tables

Privilege Escalation: AlloyDB Database Superuser Writes to User Tables

Privilege Escalation: AlloyDB Over-Privileged Grant

What's next

• Learn about Event Threat Detection.
• Refer to the Threat findings index.