detection.wiki

Security Command Center

methodNameDescriptionLog typeSampleRule
anyCatch-all entry for securitycenter.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.activityNY
google.cloud.securitycenter.SecurityCenter.BatchCreateResourceValueConfigsactivityNN
google.cloud.securitycenter.SecurityCenter.BulkMuteFindingsactivityNN
google.cloud.securitycenter.SecurityCenter.CreateBigQueryExportactivityNN
google.cloud.securitycenter.SecurityCenter.CreateEventThreatDetectionCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.CreateFindingactivityNN
google.cloud.securitycenter.SecurityCenter.CreateMuteConfigactivityNN
google.cloud.securitycenter.SecurityCenter.CreateNotificationConfigactivityNN
google.cloud.securitycenter.SecurityCenter.CreateSecurityHealthAnalyticsCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.CreateSourceactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteBigQueryExportactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteEventThreatDetectionCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteMuteConfigactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteNotificationConfigactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteResourceValueConfigactivityNN
google.cloud.securitycenter.SecurityCenter.DeleteSecurityHealthAnalyticsCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.GetBigQueryExportdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetEffectiveEventThreatDetectionCustomModuledata_accessNN
google.cloud.securitycenter.SecurityCenter.GetEffectiveSecurityHealthAnalyticsCustomModuledata_accessNN
google.cloud.securitycenter.SecurityCenter.GetEventThreatDetectionCustomModuledata_accessNN
google.cloud.securitycenter.SecurityCenter.GetIamPolicydata_accessNN
google.cloud.securitycenter.SecurityCenter.GetMuteConfigdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetNotificationConfigdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetOrganizationSettingsdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetResourceValueConfigdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetSecurityHealthAnalyticsCustomModuledata_accessNN
google.cloud.securitycenter.SecurityCenter.GetSimulationdata_accessNN
google.cloud.securitycenter.SecurityCenter.GetSourcedata_accessNN
google.cloud.securitycenter.SecurityCenter.GetValuedResourcedata_accessNN
google.cloud.securitycenter.SecurityCenter.GroupAssetsactivityNN
google.cloud.securitycenter.SecurityCenter.GroupFindingsactivityNN
google.cloud.securitycenter.SecurityCenter.ListAssetsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListAttackPathsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListBigQueryExportsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListDescendantEventThreatDetectionCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListDescendantSecurityHealthAnalyticsCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListEffectiveEventThreatDetectionCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListEffectiveSecurityHealthAnalyticsCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListEventThreatDetectionCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListFindingsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListMuteConfigsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListNotificationConfigsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListResourceValueConfigsdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListSecurityHealthAnalyticsCustomModulesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListSourcesdata_accessNN
google.cloud.securitycenter.SecurityCenter.ListValuedResourcesdata_accessNN
google.cloud.securitycenter.SecurityCenter.RunAssetDiscoveryactivityNN
google.cloud.securitycenter.SecurityCenter.SetFindingStateactivityNN
google.cloud.securitycenter.SecurityCenter.SetIamPolicyactivityNN
google.cloud.securitycenter.SecurityCenter.SetMuteactivityNN
google.cloud.securitycenter.SecurityCenter.SimulateSecurityHealthAnalyticsCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.TestIamPermissionsdata_accessNN
google.cloud.securitycenter.SecurityCenter.UpdateBigQueryExportactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateEventThreatDetectionCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateExternalSystemactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateFindingactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateMuteConfigactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateNotificationConfigactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateOrganizationSettingsactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateResourceValueConfigactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateSecurityHealthAnalyticsCustomModuleactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateSecurityMarksactivityNN
google.cloud.securitycenter.SecurityCenter.UpdateSourceactivityNN
google.cloud.securitycenter.SecurityCenter.ValidateEventThreatDetectionCustomModuleactivityNN

any: securitycenter.googleapis.com (any method)

#
ServiceName
securitycenter.googleapis.com

Description

Catch-all entry for securitycenter.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.cloud.securitycenter.SecurityCenter.BatchCreateResourceValueConfigs: BatchCreateResourceValueConfigs

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.BulkMuteFindings: BulkMuteFindings

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateBigQueryExport: CreateBigQueryExport

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateEventThreatDetectionCustomModule: CreateEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateFinding: CreateFinding

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateMuteConfig: CreateMuteConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateNotificationConfig: CreateNotificationConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateSecurityHealthAnalyticsCustomModule: CreateSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.CreateSource: CreateSource

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteBigQueryExport: DeleteBigQueryExport

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteEventThreatDetectionCustomModule: DeleteEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteMuteConfig: DeleteMuteConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteNotificationConfig: DeleteNotificationConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteResourceValueConfig: DeleteResourceValueConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.DeleteSecurityHealthAnalyticsCustomModule: DeleteSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.GetBigQueryExport: GetBigQueryExport

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetEffectiveEventThreatDetectionCustomModule: GetEffectiveEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetEffectiveSecurityHealthAnalyticsCustomModule: GetEffectiveSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetEventThreatDetectionCustomModule: GetEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetIamPolicy: GetIamPolicy

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetMuteConfig: GetMuteConfig

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetNotificationConfig: GetNotificationConfig

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetOrganizationSettings: GetOrganizationSettings

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetResourceValueConfig: GetResourceValueConfig

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetSecurityHealthAnalyticsCustomModule: GetSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetSimulation: GetSimulation

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetSource: GetSource

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GetValuedResource: GetValuedResource

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.GroupAssets: GroupAssets

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.GroupFindings: GroupFindings

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.ListAssets: ListAssets

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListAttackPaths: ListAttackPaths

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListBigQueryExports: ListBigQueryExports

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListDescendantEventThreatDetectionCustomModules: ListDescendantEventThreatDetectionCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListDescendantSecurityHealthAnalyticsCustomModules: ListDescendantSecurityHealthAnalyticsCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListEffectiveEventThreatDetectionCustomModules: ListEffectiveEventThreatDetectionCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListEffectiveSecurityHealthAnalyticsCustomModules: ListEffectiveSecurityHealthAnalyticsCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListEventThreatDetectionCustomModules: ListEventThreatDetectionCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListFindings: ListFindings

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListMuteConfigs: ListMuteConfigs

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListNotificationConfigs: ListNotificationConfigs

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListResourceValueConfigs: ListResourceValueConfigs

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListSecurityHealthAnalyticsCustomModules: ListSecurityHealthAnalyticsCustomModules

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListSources: ListSources

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.ListValuedResources: ListValuedResources

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.RunAssetDiscovery: RunAssetDiscovery

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.SetFindingState: SetFindingState

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.SetIamPolicy: SetIamPolicy

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.SetMute: SetMute

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.SimulateSecurityHealthAnalyticsCustomModule: SimulateSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.TestIamPermissions: TestIamPermissions

#
ServiceName
securitycenter.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.securitycenter.SecurityCenter.UpdateBigQueryExport: UpdateBigQueryExport

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateEventThreatDetectionCustomModule: UpdateEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateExternalSystem: UpdateExternalSystem

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateFinding: UpdateFinding

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateMuteConfig: UpdateMuteConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateNotificationConfig: UpdateNotificationConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateOrganizationSettings: UpdateOrganizationSettings

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateResourceValueConfig: UpdateResourceValueConfig

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateSecurityHealthAnalyticsCustomModule: UpdateSecurityHealthAnalyticsCustomModule

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateSecurityMarks: UpdateSecurityMarks

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.UpdateSource: UpdateSource

#
ServiceName
securitycenter.googleapis.com

google.cloud.securitycenter.SecurityCenter.ValidateEventThreatDetectionCustomModule: ValidateEventThreatDetectionCustomModule

#
ServiceName
securitycenter.googleapis.com