DET-C12: Audit logging blinded by a logging sink or exclusion¶
A logging exclusion or sink change dropped Data Access or Admin Activity entries for the project: the records these Confidential Space detections read stop arriving.
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space |
| Group | cloud |
| Log source | Cloud Audit Logs · Logging |
| Related check | CSPACE-KMS-01: Cloud KMS decrypt is federated through the attested pool |
Fires when¶
logging CreateExclusion / UpdateSink / DeleteSink AND scope covers the workload project's audit logs
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.