关于Google Security Command Center异常检测事件日志配置的技术问询

Hey there, let's break down how to handle logging for both Anomaly Detection and Container Threat Detection in Google Security Command Center (SCC), based on my hands-on experience with these tools:

Anomaly Detection Logging #

• First off, your hunch is spot-on! Anomaly Detection events follow the exact same logging pattern as Event Threat Detection. Even though there's no dedicated official documentation for its logging setup, once you've enabled Anomaly Detection at the project or organization level in SCC, all its detection events are automatically routed to Cloud Logging (previously Stackdriver Logging) under the Threat Detector resource type.
• To confirm this, head to Cloud Logging and use this filter to pull related logs:

  resource.type="threat_detector" AND logName:"anomaly-detection"
  

  You’ll see entries for anomalies like unusual access patterns or unexpected resource usage spikes here.

Container Threat Detection Logging #

• Container Threat Detection logs are stored differently than the other two. Instead of the Threat Detector resource, its events are tied to relevant compute resources, and you can target them with specific filters:
  • Use this query to fetch all Container Threat Detection logs directly:

    logName:"/logs/cloud.googleapis.com%2Fcontainer_threat_detection"
    

  • If you want to narrow results by resource type (like Kubernetes containers or GCE instances), combine the log filter with resource-specific rules:

    (resource.type="k8s_container" OR resource.type="gce_instance") AND logName:"/logs/cloud.googleapis.com%2Fcontainer_threat_detection"
    

• A quick pro tip: You can jump straight to the logs from an SCC Finding. Just open any Container Threat Detection finding, look for the "View Logs" link, and it’ll take you directly to the corresponding Cloud Logging entry.

Quick Validation Checks #

• For Anomaly Detection: Run resource.type="threat_detector" in Cloud Logging, then inspect the logName field of entries—you’ll see paths containing anomaly-detection to confirm the source.
• For Container Threat Detection: After running the filter above, verify logs include details like image vulnerability alerts or malicious process detections.

内容的提问来源于stack exchange，提问作者Oleksandr Zelko