GoogleCloudSCC

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

---

Reference for GoogleCloudSCC table in Azure Monitor Logs.

Attribute	Value
Category	GCP
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✓ Yes
Azure Monitor Tables Reference	View Documentation
Azure Monitor Logs Ingestion API	View Documentation

Contents

• Schema
• Solutions
• Connectors
• Content Items

Schema (9 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
Findings	dynamic	A Dynamic array of all the findings associated with the resource.
FindingsResource	dynamic	A Dynamic array of the resource that was affected by the security finding.
SourceProperties	dynamic	A map of additional properties about the source of the security finding.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The time at which the security finding was first detected.
Type	string	The name of the table

Solutions (1)

This table is used by the following solutions:

• Google Cloud Platform Security Command Center

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Google Security Command Center

---

Content Items Using This Table (10)

Analytic Rules (5)

In solution Google Cloud Platform Security Command Center:

Analytic Rule	Selection Criteria
GCP Security Command Center - Detect DNSSEC disabled for DNS zones
GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
GCP Security Command Center - Detect Open/Unrestricted API Keys
GCP Security Command Center - Detect Resources with Logging Disabled
GCP Security Command Center - Detect projects with API Keys present

Hunting Queries (5)

In solution Google Cloud Platform Security Command Center:

Hunting Query	Selection Criteria
Identify Compute VMs with Secure Boot Disabled
Identify GCP Instances with Full API Access
Identify GCP Service Account with Overly Permissive Roles
Identify GCP User-Managed Service Account Keys
Identify Public GCP Storage Buckets

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index