This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.
Finding description
Security Command Center examines audit logs to detect the anomalous deletion of a template. A template is a base configuration for backups that can be applied to multiple applications.
Step 1: Review finding details
- Open the
Impact: Google Cloud Backup and DR delete template
finding, as detailed in Reviewing findings. The details panel for the finding opens to the Summary tab. - On the Summary tab, review the information in the following sections:
- What was detected, especially the following fields:
- Template name: the name for a set of policies that define backup frequency, schedule, and retention time
- Principal subject: a user that has successfully executed an action
- Affected resource
- Resource display name: the project in which the template was deleted
- Related links, especially the following fields:
- MITRE ATTACK method: link to the MITRE ATT&CK documentation
- Logging URI: link to open the Logs Explorer
- What was detected, especially the following fields:
Step 2: Research attack and response methods
Contact the owner of the service account in the Principal email field. Confirm whether the legitimate owner conducted the action.
Step 3: Implement your response
The following response plan might be appropriate for this finding. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.
- In the project where the action was taken, navigate to the management console.
- In the App Manager tab, find the affected applications that are no longer protected and review backup policies for each.
- To re-add a template, navigate to the Backup Plans tab, select Templates, then select the Create Template option.
What's next
- Learn how to work with threat findings in Security Command Center.
- Refer to the Threat findings index.
- Learn how to review a finding through the Google Cloud console.
- Learn about the services that generate threat findings.