↳ GitHub sourceAnalytics ruleMedium

GCP Security Command Center - Detect Resources with Logging Disabled

Description

Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1562

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

GoogleSCCDefinition

Data types

GoogleCloudSCC

KQL query

Original query, unchanged.

GoogleCloudSCC
| where tostring(Findings.state) == "ACTIVE"
| extend FindingCategory = tostring(Findings.category)
| where FindingCategory in ("BUCKET_LOGGING_DISABLED", "FIREWALL_RULE_LOGGING_DISABLED", "DNS_LOGGING_DISABLED")
| extend FindingsJson = parse_json(Findings)
| extend Resource = tostring(FindingsJson.resourceName),
         ExternalUri = tostring(FindingsJson.externalUri),
         Description = tostring(FindingsJson.description),
         Severity = tostring(FindingsJson.severity),
         ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
         ResourceType = extract(@"//([a-z0-9_.-]+)/", 1, tostring(FindingsJson.resourceName)),
         SourceProps = parse_json(tostring(FindingsJson.sourceProperties))
// Normalize display-friendly resource id
| extend ResourceName = case(
    Resource contains "firewalls/", extract(@"firewalls/([^/]+)", 1, Resource),
    Resource contains "storage.googleapis.com/", extract(@'storage.googleapis.com/([^/\"]+)', 1, Resource),
    Resource contains "networks/", extract(@"networks/([^/]+)", 1, Resource),
    Resource
  )
| project TimeGenerated, ProjectName, ResourceType, ResourceName, Resource, FindingCategory, Severity, ExternalUri, Description

Declared entities

CloudApplication

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yaml ↗
Commit: 9800e51 ↗
Source identifier: d1fe8d30-4852-463a-b6ee-3b459788b75d

Additional source files 2

Solutions/Google Cloud Platform Security Command Center/Analytic Rules/GCPLoggingDisabled.yamlsource ↗Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.