Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-2-2La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Affichage de SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basé sur la classification professionnelle SOC
| name | cis-gcp-foundations-2.2 |
| description | Ensure That Sinks Are Configured for All Log Entries |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","logging","monitoring","log-sinks","cloud-audit"] |
| cis_id | 2.2 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).
Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.
There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.
Logs Router by visiting https://console.cloud.google.com/logs/router.View sink details.empty Inclusion filter.Destination exists.empty filter exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project:gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID
The output should list at least one sink with an empty filter.
Destination exists.See https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list for more information.
At least one sink with an empty filter is configured, and the destination resource exists.
Logs Router by visiting https://console.cloud.google.com/logs/router.CREATE SINK text.Sink details.Create Sink.For more information, see https://cloud.google.com/logging/docs/export/configure_export_v2#dest-create.
To create a sink to export all log entries in a Google Cloud Storage bucket:
gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME
Sinks can be created for a folder or organization, which will include all projects.
gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME --include-children --folder=FOLDER_ID | --organization=ORGANIZATION_ID
Note:
Custom Destination.--log-filter is not used to ensure the sink exports all log entries.--include-children in the gcloud command.By default, there are no sinks configured.
For Command-Line Audit and Remediation, the sink destination of type Cloud Storage Bucket is considered. However, the destination could be configured to Cloud Storage Bucket or BigQuery or Cloud Pub\Sub or Custom Destination. Command Line Interface commands would change accordingly.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | x | x | x |
| v8 | 8.3 Ensure Adequate Audit Log Storage | x | x | x |
| v7 | 6.2 Activate audit logging | x | x | x |
| v7 | 6.4 Ensure adequate storage for logs | x | x |
Level 1