Question

A SecOps engineer is designing a detection strategy for compromised GCP identities. The organization uses Security Command Center Premium, Google SecOps SIEM ingesting Cloud Audit Logs, and Cloud IDS. Leadership wants the fastest reliable signal when a service account key is used from an anomalous geographic location to enumerate IAM permissions. Which telemetry source should the engineer prioritize as the primary detection input for this specific behavior, and why?

Accepted Answer

Cloud Audit Logs (Admin Activity) ingested into Google SecOps, because they record the IAM API calls, caller identity, and source IP needed to correlate location with enumeration activity in a YARA-L rule

Answer

Cloud IDS, because its deep packet inspection detects anomalous authentication traffic patterns from unusual geographies

Answer

SCC Security Health Analytics findings, because they continuously flag service accounts with overly permissive roles

Answer

SCC Web Security Scanner results, because they identify exposed credentials that could enable key-based access