GCP Cloud Shell
Cloud Shell is GCP’s native command-line tool that allows access to various GCP services over a command-line interface. GCP Cloud Shell, a browser-based shell environment, can be used to investigate and identify potential security incidents for threat-hunting activities. Investigators can also use Cloud Shell to turn a service such as packet mirroring on or off. It also has an interactive code editor for users or investigators who want to import custom code, enabling Cloud Shell to perform certain activities. GCP’s Cloud Shell can also be accessed locally through the Google Cloud SDK or an in-browser session.
GCP offers essential command-line tools, specifically gcloud
and gsutil
. gcloud
provides access to general GCP services such as GCE, BigQuery, and so on. In comparison, gsutil
is a specific utility tool to access storage buckets.
Through gcloud
, investigators can access Logs Explorer and collect all the associated logs for offline analysis....