Security Command Center Premium: Step 2 - Integrat...

andras · 3 weeks ago

Security Command Center Premium (SCCP) has a number of integrated services that can be easily enabled to provide you with deep information about the security posture of your organization. We've already covered Web Security Scanner and VM Manager in the Onboarding section. In this section we will cover the implementation of Anomaly Detection and Sensitive Data Protection.

Prerequisites

Security Command Center Premium activated at the Organization or Project level.
Data ingestion into SCCP happening successfully.

Actions

Anomaly Detection

Anomaly Detection uses behavior signals from outside your system to identify and display security anomalies for your projects and Virtual Machine instances.

Prerequisites

See the Relevant Links section for more documentation regarding the prerequisites.

SCC enabled at the organization level (Anomaly Detection not available at the Project level).

Steps

Anomaly Detection is enabled by default and requires no further action from you. It's just worth spending a moment to discuss what it is and how it works.
In order to anlyze any issues that Anomaly Detection finds, you will want to go to the Findings tab in SCC.

Relevant Links

All Steps: https://cloud.google.com/security-command-center/docs/concepts-security-sources#anomaly_detection

Prerequisites See the Relevant Links section for more documentation regarding the prerequisites. SCC enabled at the organization level (Anomaly Detection not available at the Project level). Steps Anomaly Detection is enabled by default and requires no further action from you. It's just worth spending a moment to discuss what it is and how it works. In order to anlyze any issues that Anomaly Detection finds, you will want to go to the Findings tab in SCC. Relevant Links All Steps: https://cloud.google.com/security-command-center/docs/concepts-security-sources#anomaly_detection

Sensitive Actions Service

Sensitive Actions Service is a built-in service of the Security Command Center Premium tier that detects when actions are taken in your Google Cloud organization, folders, and projects that could be damaging to your business if they are taken by a malicious actor.

Prerequisites

See the Relevant Links section for more documentation regarding the prerequisites.

Security Command Center Premium Tier.

Steps

Sensitive Actions Service automatically enabled on Security Command Center Premium Tier, no further action is required on your part.
Navigate to the Security Command Center console. Along the top of the SCC console you will see three tabs, select Findings.
Ensure you've selected the appropriate organization or project.
In the Quick Filters section, Source Display Name subsection, select Sensitive Actions Service.
To view the details of a Finding click the finding name under Category.
To display all findings about a specific user, copy the email address next to Principal Email, then close the Details pane.
In Query Builde, build the following query:
```
access.principal_email='USER_EMAIL'
```
. Replace
```
USER_EMAIL
```
with the email address you copied in step 6.

Relevant Links

All Steps: https://cloud.google.com/security-command-center/docs/how-to-use-sensitive-actions#findings-scc

Prerequisites See the Relevant Links section for more documentation regarding the prerequisites. Security Command Center Premium Tier. Steps Sensitive Actions Service automatically enabled on Security Command Center Premium Tier, no further action is required on your part. Navigate to the Security Command Center console. Along the top of the SCC console you will see three tabs, select Findings. Ensure you've selected the appropriate organization or project. In the Quick Filters section, Source Display Name subsection, select Sensitive Actions Service. To view the details of a Finding click the finding name under Category. To display all findings about a specific user, copy the email address next to Principal Email, then close the Details pane. In Query Builde, build the following query: access.principal_email='USER_EMAIL' . Replace USER_EMAIL with the email address you copied in step 6. Relevant Links All Steps: https://cloud.google.com/security-command-center/docs/how-to-use-sensitive-actions#findings-scc

Next Step: Security Command Center Premium: Step 3 - Cloud Logging