Security Command Center Enterprise: Step 3.1 - Investigation | Web Security Scanner

Steps

1. To start, users will need to enable Web Security Scanner in the Security Command Center to create and run custom scans.
2. Users will go to any dashboard in the left-side panel under Security Command Center in Google Cloud Console. Then select the Settings button  at the top-right corner of the screen. Users will see be brought to the Settings page.
3. Users will select the Web Security Scanner selection under the Services tab, by clicking the Manage Settings link. 
4. Users will only see a Service Enablement page, to enable or disable Web Security Scanner. Note: Settings inherit from the parent resource unless overridden on the child resource.
5. At the top of the Service Enablement list, users will see the Search For a Folder or Project button link, if they need to search for particular Folder or Project.
6. The Service Enablement list of Folder or Projects will display the following columns:
   1. Name
   2. Resource ID
   3. Web Security Scanner
7. When users see the Folder or Project they choose to enable, they will go to the Web Security Scanner column and select to enable the Folder or Project.
8. To access the Web Security Scanner feature, users will go to the left-side panel of the Google Cloud Console, and select Web Security Scanner under the Detections and Controls section.
9. When selected, users will see a feature titled Cloud Web Security Scanner. If this is the first time accessing it, users may see displayed instructions to Enable the Web Security Scanner API. Select Enable API, which could take a minute to Enable.
10. Once Enabled, users will see the Create a New Scan button in the middle of the dashboard. 
11.  Users will see the Create a New Scan page, with the following input fields:
    1. Name 
    2. Starting URLs
    3. Excluded URLs
    4. Export Options
12. In the Starting URLs field, users can list one or more apps they wish to scan hosted on App Engine Standard or Flexible, Compute Engine or GKE environments. When the field is entered, users can choose to add more URLs by selecting the Add a URL button. 
13. In the Excluded URLs field, users can list one or more apps they wish to exclude from scanning. Users can Add a URL to Exclude list, by selecting the Add a URL button. 
14. In the Excluded URLs section is a Authentication field with the following options:
    1. None
    2. Google Account
    3. Non-Google Account
    4. Identity-Aware Proxy
15. Below the Authentication field in the Excluded URLs section, is the Schedule field, with the following options:
    1. Daily
    2. Weekly
    3. Every 2 Weeks
    4. Every 4 Weeks
    5. Never
16. Below the Schedule field in the Excluded URLs section, is a Run Scans section, that allows users to run scans from a pre-defined set of IP addresses, that users can select by checking the box.
17. In the Export Options section, users can also Export scan configurations and scan results to the Security Command Center after scans are complete.
18. Also, in the Export Options section, users can enter selections for the following:
    1. User Agent
    2. Maximum Scan Speed
    3. Risk Level
    4. Ignore HTTP Status Errors
19. When all field are complete, users will select Save at the bottom of the page.

Relevant Documentation Links

• [All Steps] https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview