影響：Google Cloud 備份與 DR 縮短備份到期日

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

Event Threat Detection 會檢查稽核記錄，偵測備份和災難復原服務設備上的備份到期日是否已縮短。

Event Threat Detection 是這項發現項目的來源。

回應方式

如要回應這項發現項目，請按照下列步驟操作：

步驟 1：查看調查結果詳細資料

  1. 如「查看發現項目」一文所述，開啟發現項目。Impact: Google Cloud Backup and DR reduced backup expiration系統會開啟發現項目的詳細資料面板，並顯示「摘要」分頁。
  2. 在「摘要」分頁中，查看下列各節的資訊：
    • 偵測到的內容，尤其是下列欄位：
      • 說明：偵測資訊
      • 主體：成功執行動作的使用者或服務帳戶
    • 受影響的資源
      • 資源顯示名稱：備份到期時間縮短的專案。
    • 相關連結，尤其是下列欄位：
      • MITRE ATTACK 方法：連結至 MITRE ATT&CK 文件。
      • 記錄 URI：開啟 Logs Explorer 的連結。

步驟 2：研究攻擊和應變方法

聯絡「Principal subject」(主體) 欄位中的服務帳戶擁有者。 確認正當擁有者是否執行了該項操作。

步驟 3：實作回應

下列應變計畫可能適用於這項發現，但也可能影響作業。 請仔細評估調查期間收集到的資訊，找出解決問題的最佳方式。

  1. 在執行動作的專案中，前往管理控制台。
  2. 在「應用程式管理員」分頁中，找出備份到期日縮短的受影響應用程式，並確認到期日縮短是主體所為。
  3. 如要啟動應用程式的新備份作業，請選取「管理備份設定」，建立隨選備份或排定新的備份作業。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
  "finding": {
    "access": {
      "principalEmail": "USER_EMAIL",
      "callerIp": "CALLER_IP",
      "callerIpGeo": {
        "regionCode": "REGION_CODE"
      },
      "serviceName": "backupdr.googleapis.com",
      "methodName": "updateBackup",
      "principalSubject": "user:USER_EMAIL"
    },
    "attackExposure": {},
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/FINDING_LOCATION/findings/FINDING_ID",
    "category": "Impact: Google Cloud Backup and DR reduced backup expiration",
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "createTime": "EVENT_TIMESTAMP",
    "database": {},
    "description": "The expiration date for a backup has been reduced.",
    "eventTime": "EVENT_TIMESTAMP",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "INHIBIT_SYSTEM_RECOVERY"
      ]
    },
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "severity": "MEDIUM",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "display_name": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "project_display_name": "PROJECT_ID",
    "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parent_display_name": "FOLDER_NAME",
    "folders": []
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "backup_reduce_backup_expiration"
    },
    "detectionPriority": "LOW",
    "affectedResources": [
      {
        "gcpResourceName": "//backupdr.googleapis.com/projects/PROJECT_NUMBER"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "0",
            "nanos": 0.0
          },
          "insertId": "INSERT_ID"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1490/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    },
    "description": "The expiration date for a backup has been reduced."
  }
}

後續步驟