Are TsunamiSecurityScanner queries on cloud run instances an attack or Google check?

Question

During the night, all my cloud run instances on the same project (there are python and node.js instances) received numerous requests with the tag TsunamiSecurityScanner (see attached image) ? Is this an attack (like JNDI injection)? Or a normal Google check?

There is nothing related to that in my Security Command Center in my GCP console. And i have see in Google github the TsunamiSecurityScanner is open source and not an official product (?).

Anyone have a clue ? Thanks by advance,

Answer 1

TsunamiSecurityScanner queries are officially from Google and not a cyber attack. They are part of the Rapid Vulnerability Detection (RVD) with Security Command Center. Currently, there is no fixed set of IP addresses for RVD, so you cannot allowlist the traffic because the IP addresses are not static and may change. However, there is an ongoing internal feature request to address this. You can track its status here in this Public Issue Tracker.