Question

Your security operations team relies on Security Command Center Premium. Overnight, an attacker used stolen credentials to grant themselves the Owner role on a production project. The SOC wants Google-managed detection that automatically surfaces this kind of suspicious IAM behavior from Cloud Audit Logs as a finding, without the team having to author and maintain custom log-based metrics or detection rules. Which capability should they rely on?

Accepted Answer

Event Threat Detection, which analyzes Cloud Audit Logs in near real time and produces findings such as anomalous or suspicious IAM grants

Answer

Security Health Analytics, which continuously scans resource configurations to detect misconfigurations against a baseline

Answer

A Cloud Logging log-based metric with an alerting policy that triggers on SetIamPolicy method entries

Answer

Web Security Scanner, which crawls deployed App Engine and Compute Engine web apps for vulnerabilities