Detection: DLP Re-identify Content

Overview

Detect when GCP DLP content was re-identified. Re-identification of sensitive content can expose private data or violate data privacy regulations. Monitoring such actions helps maintain compliance, protect sensitive data, and prevent unauthorized disclosures.

References:

Google Cloud Audit Logs

Usage

Run the detection in your terminal:

powerpipe detection run gcp_audit_log_detections.detection.dlp_reidentify_content

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run gcp_audit_log_detections.detection.dlp_reidentify_content --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
  method_name as operation,
  resource_name as resource,
  authentication_info.principal_email as actor,
  tp_source_ip as source_ip,
  tp_index as project,
  tp_id as source_id,
  -- Create new aliases to preserve original row data
  operation as operation_src,
  resource as resource_src,
  * exclude operation,
  resource
from
  gcp_audit_log
where
  method_name ilike 'google.privacy.dlp.v%.dlpservice.reidentifycontent'
  and severity != 'Error'
order by
  timestamp desc;

Detection: DLP Re-identify Content

Overview

Usage

SQL

Tags