Using Sensitive Actions Service

This page shows you how to review Sensitive Actions Service findings in the Google Cloud console and includes examples of Sensitive Actions Service findings.

Sensitive Actions Service is a built-in service of Security Command Center that detects when actions are taken in your Google Cloud organization, folders, and projects that could be damaging to your business if they are taken by a malicious actor. To learn more, see Sensitive Actions Service overview.

Reviewing Sensitive Actions Service findings

Sensitive Actions Service is always enabled when you activate to the Security Command Center Standard tier, and cannot be disabled. For more information about Sensitive Actions Service finding types, see Findings.

When Sensitive Actions Service detects an action that is considered sensitive, it creates a finding and a log entry. You can view the finding in the Google Cloud console. You can query the log entries in Cloud Logging. To test Sensitive Actions Service, perform a sensitive action and make sure the finding appears on the Findings page in the Google Cloud console. For more information, see Testing Sensitive Actions Service.

Reviewing findings in Security Command Center

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.

To review Sensitive Actions Service findings in the console, follow these steps:

Google Cloud console

In the Google Cloud console, go to the Findings page of Security Command Center.
Go to Findings
Select your Google Cloud project or organization.
In the Quick filters section, in the Source display name subsection, select Sensitive Actions Service. The findings query results are updated to show only the findings from this source.
To view the details of a specific finding, click the finding name under Category. The details panel for the finding opens and displays the Summary tab.
On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
Optional: To view the full JSON definition of the finding, click the JSON tab.

Security Operations console (Preview)

In the Security Operations console, go to the Findings page.
```
https://CUSTOMER_SUBDOMAIN.backstory.chronicle.security/posture/findings
```
Replace CUSTOMER_SUBDOMAIN with your customer-specific identifier.
In the Aggregations section, click to expand the Source Display Name subsection.
Select Sensitive Actions Service. The findings query results are updated to show only the findings from this source.
To view the details of a specific finding, click the finding name under Category. The details panel for the finding opens and displays the Summary tab.
On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
Optional: To view the full JSON definition of the finding, click the JSON tab.

View the findings caused by the same actor

When investigating whether a sensitive action was taken by a malicious actor, consider searching for other findings caused by that actor.

To view all findings caused by the same actor, follow these steps:

Open the finding and view its details.
On the finding details pane, copy the email address next to Principal email.
Close the pane.
In the query editor, enter the following query:
```
access.principal_email="PRINCIPAL_EMAIL"
```
Replace PRINCIPAL_EMAIL with the email address that you previously copied. Security Command Center displays all findings that are associated with actions taken by the actor that you specified.

Viewing findings in Cloud Logging

Sensitive Actions Service writes a log entry to the Google Cloud platform logs for each sensitive action if finds. These log entries are written even if you have not enabled Security Command Center.

To view the log entries for sensitive actions in Cloud Logging, do the following:

Go to Logs Explorer in the Google Cloud console.

Go to Logs Explorer
In the Project selector at the top of the page, select the project for which you would like to see the Sensitive Actions Service log entries. Alternatively, to see log entries at the organization level, select the organization.
In the Query text box, enter the following resource definition: resource.type="sensitiveaction.googleapis.com/Location"
Click Run Query. The Query results table is updated with any matching log entries that were written within the time period of your query.
To view the details of a log entry, click a table row, then click Expand nested fields.

You can create advanced log queries to specify a set of log entries from any number of logs.

Example Finding Formats

This section includes the JSON output for the Sensitive Actions Service findings as they appear when you create exports from the Google Cloud console or run list methods in the Security Command Center API.

The output examples contain the fields most common to all findings. However, all fields might not appear in every finding. The actual output you see depends on a resource's configuration and the type and state of findings.

To see example findings, expand one or more of the following nodes.

Defense Evasion: Organization Policy Changed

This finding isn't available

Learn how to { "findings": { "access": { "principalEmail": "`PRINCIPAL_EMAIL`", "callerIp": "`PRINCIPAL_IP_ADDRESS`", "callerIpGeo": { "regionCode": "US" }, "serviceName": "orgpolicy.googleapis.com", "methodName": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy", "principalSubject": "user:`PRINCIPAL_EMAIL`" }, "canonicalName": "organizations/`ORGANIZATION_ID`/sources/`SOURCE_ID`/findings/`FINDING_ID`", "category": "Defense Evasion: Organization Policy Changed", "contacts": { "technical": { "contacts": [ { "email": "`EMAIL_ADDRESS_1`" }, { "email": "`EMAIL_ADDRESS_2`" }, ] } }, "createTime": "2022-08-27T12:35:30.466Z", "database": {}, "eventTime": "2022-08-27T12:35:30.264Z", "exfiltration": {}, "findingClass": "OBSERVATION", "indicator": {}, "kubernetes": {}, "mitreAttack": { "primaryTactic": "DEFENSE_EVASION", "primaryTechniques": [ "IMPAIR_DEFENSES" ] }, "mute": "UNDEFINED", "name": "organizations/`ORGANIZATION_ID`/sources/`SOURCE_ID`/findings/`FINDING_ID`", "parent": "organizations/`ORGANIZATION_ID`/sources/`SOURCE_ID`", "parentDisplayName": "Sensitive Actions", "resourceName": "//orgpolicy.googleapis.com/organizations/`ORGANIZATION_ID`/policies/storage.publicAccessPrevention", "severity": "LOW", "sourceDisplayName": "Sensitive Actions Service", "state": "ACTIVE", "vulnerability": {}, "workflowState": "NEW" }, "resource": { "name": "//orgpolicy.googleapis.com/organizations/`ORGANIZATION_ID`/policies/storage.publicAccessPrevention", "display_name": "", "project_name": "", "project_display_name": "", "parent_name": "", "parent_display_name": "", "type": "", "folders": [] }, "sourceProperties": { "sourceId": { "organizationNumber": "`ORGANIZATION_ID`", "customerOrganizationNumber": "`ORGANIZATION_ID`" }, "detectionCategory": { "ruleName": "sensitive_action", "subRuleName": "change_organization_policy" }, "detectionPriority": "LOW", "affectedResources": [ { "gcpResourceName": "//orgpolicy.googleapis.com/organizations/`ORGANIZATION_ID`" }, { "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/`ORGANIZATION_ID`" }, { "gcpResourceName": "//orgpolicy.googleapis.com/organizations/`ORGANIZATION_ID`/policies/storage.publicAccessPrevention" } ], "evidence": [ { "sourceLogId": { "resourceContainer": "organizations/`ORGANIZATION_ID`", "timestamp": { "seconds": "1661603725", "nanos": 12242032 }, "insertId": "`INSERT_ID`" } } ], "properties": {}, "findingId": "`FINDING_ID`", "contextUris": { "mitreUri": { "displayName": "MITRE Link", "url": "https://attack.mitre.org/techniques/T1562/" }, "cloudLoggingQueryUri": [ { "displayName": "Cloud Logging Query Link", "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-08-27T12:35:25.012242032Z%22%0AinsertId%3D%22`INSERT_ID`%22%0Aresource.labels.project_id%3D%22%22?project=" } ], "relatedFindingUri": {} } } } notranslate" id="defense-evasion:-remove-billing-admin" data-text="Defense Evasion: Remove Billing Admin" tabindex="-1">Defense Evasion: Remove Billing Admin

Last updated 2024-09-20 UTC.