What is Event Threat Detection?
Event Threat Detection is a security service in Security Command Center Premium that continuously analyzes cloud logs for threats. The service uses machine learning and rule-based detection to identify suspicious activities such as malware, cryptomining, or data exfiltration.
Core Features
- Automatic analysis of Cloud Audit Logs and VPC Flow Logs
- Detection of malware, cryptomining, and unusual behavior
- Near real-time notifications for threats
- Integration with Security Command Center for central overview
- Export of findings to external SIEM systems
Typical Use Cases
Detection of Compromised Accounts: Event Threat Detection identifies unusual IAM activities such as access from unusual regions or creation of suspicious service accounts.
Malware Detection: The service detects known malware communication patterns and suspicious network activities that could indicate compromised workloads.
Compliance Monitoring: Continuous monitoring for security-relevant configuration changes and suspicious administrator activities to meet audit requirements.
Benefits
- Automatic detection without manual log analysis
- Use of Google’s Threat Intelligence
- Central security overview in Security Command Center
- Fast response through real-time findings
Integration with innFactory
As a Google Cloud Partner, innFactory supports you with Event Threat Detection: setup of Security Command Center, integration into existing security workflows, and development of incident response processes.
Available Tiers & Options
Security Command Center Premium
- Automatic threat detection
- Continuous log analysis
- Integration with SIEM systems
- Only available in Premium tier
- Requires Security Command Center
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Event Threat Detection?
Event Threat Detection is a component of Security Command Center Premium that continuously analyzes Cloud Audit Logs and VPC Flow Logs for threats and generates findings for suspicious activities.
What threats are detected?
The service detects malware, cryptomining, unusual IAM activities, data exfiltration, SSH brute-force attacks, and suspicious API calls, among others.
How quickly are threats detected?
Event Threat Detection analyzes logs in near real-time. Most threats are detected and reported as findings within minutes of occurrence.
Can I create custom detection rules?
Event Threat Detection uses predefined detection rules from Google. For custom rules, you can use Chronicle SIEM or custom log-based alerts in Cloud Monitoring.
