GCP Audit: Sensitive Data Re-identified via projects.content.reidentify

Detects Google Cloud DLP re-identification activity using projects.content.reidentify in audit logs.

FreeUnreviewedSigmamediumv1

gcp-audit-sensitive-data-re-identified-via-projects-content-reidentify-234f9f48

title: "GCP Audit: Sensitive Data Re-identified via projects.content.reidentify"
id: 63884c9e-9536-4d5c-8d4d-00672b58c64f
status: test
description: This rule flags Google Cloud audit events where the DLP content re-identification operation is invoked. Re-identification can turn anonymized or de-identified data back into sensitive, identifiable information, increasing privacy and data-exposure risk. It relies on GCP audit log telemetry capturing method_name values for DLP re-identify actions.
references:
  - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1565
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name: projects.content.reidentify
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 234f9f48-904b-4736-a34c-55d23919e4b7
    type: derived

What it detects

This rule flags Google Cloud audit events where the DLP content re-identification operation is invoked. Re-identification can turn anonymized or de-identified data back into sensitive, identifiable information, increasing privacy and data-exposure risk. It relies on GCP audit log telemetry capturing method_name values for DLP re-identify actions.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.