Skip to main content

Security Command Center

Questions about Security Command Center? You've come to the right place. Connect with other SCC users, discuss best practices, overcome challenges.

  • 62 Topics
  • 106 Replies
62 Topics
D
DrilonOsmaniNew Member
posted in Security Command Center
Vulnerability & Patch Management

We are currently experiencing an issue with our Airflow Composer service, which is managed by GCP and hosted in an Autopilot Kubernetes cluster. Specifically, we have identified some active vulnerabilities (GKE runtime OS vulnerabilities) associated with this service.Given the nature of the Autopilot Kubernetes cluster, we are limited in our ability to directly modify the cluster, restricting us to initiating updates only. Despite multiple attempts to upgrade to the latest versions, including unstable versions of Airflow Composer, the vulnerabilities remain unresolved.Could you please provide guidance or assistance in addressing these vulnerabilities? 

32
D
C
camelmasaNew Member
asked in Security Command Center
Security Command Centre Premium Tier's price

Hi, We'll enable SCC premium tier plan. But I'm worried about the increased costs.If We end up paying more than I expected, can we revert to the standard plan even after only a few days of use? Thanks,

31
R
Staff
A
Staff
andras11Staff
posted in Security Command Center
Google Cloud's VM Threat Detection + Exciting New VMTD Previews

Cloud security threats are always evolving. While many focus on the network layer, insidious threats like cryptocurrency miners, rootkits, and sophisticated malware target the heart of your virtual machines (VMs). Google Cloud's Security Command Center (SCC) offers a powerful solution: VM Threat Detection. VM Threat Detection findings are high-severity threats that we recommend you fix immediately What is VM Threat Detection? VM Threat Detection is a built-in service within SCC Premium. It goes beyond traditional endpoint agents by working at the hypervisor level of your Google Cloud infrastructure. This means it scans your VM memory and disks for malicious applications, even if those threats try to hide themselves. Key targets include cryptocurrency mining software, kernel-mode rootkits, and other advanced malware. How VM Threat Detection Works Under the Hood: VM Threat Detection is embedded in Google Cloud's secure hypervisor, ensuring deep visibility into VMs without installing a

42
A
Staff
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Security Command Center
Cloud Security Podcast - Doing Cloud IAM Right

On August 7th at 1PM PT, there will be a Cloud Security Podcast discussion on Identity and Access Management (IAM) and how catching IAM mistakes. Michele Chubirka and Sita Lakshmi Sangameswaran will delve into why IAM is the foundation of a secure cloud infrastructure. Click here for more information.

00
matthewnichols
Community Manager
D
dheerajpanyamBronze 4
posted in Security Command Center
Using the SCC APIs to build a lightweight version of SCC product

I want to build a lightweight version of SCC for internal usage within my Organization  using the SCC APIs (either the google cloud client libraries or the REST API). Looking at the APIs  documentation my understanding is that APIs only support discovering assets / findings  and application vulnerability features of SCC. I see the below features of SCCAsset Discovery and Inventory (APIs available)Unified security findings (APIs unavailable)Notifcations and actions (APIs unavailabe)Application vulnerability detection (APIs available)Misconfiguration detection (APIs unavailabe)Anomaly detection (APIs unavailabe)Threat detection (APIs unavailabe)Container runtime security) (APIs unavailabe)

314
A
Staff
N
nc2Bronze 5
asked in Security Command Center
SCC detection of commands on OS level

Is SCC able to detect remote commands / commands on an OS on a kernel level.

11
A
Staff
N
nc2Bronze 5
asked in Security Command Center
SCC vs Google SecOps (aka former Chronicle + Chronicle SOAR). What is the difference?

Are they two different products? I see that they are both tools: "capable of being integrated" but I don't see any distinguishing documentation between the two separating them, only saying that they can be used in conjunction.

61
A
Staff
vaskenh
Staff
vaskenhStaff
asked in Security Command Center
Introducing Security Command Center Enterprise!

We are excited to announce general availability of Security Command Center (SCC) Enterprise – the industry's first multi-cloud risk management solution that converges cloud security and enterprise security operations capabilities, and is supercharged by Mandiant expertise and AI. With this launch, we’re delivering 120+ new capabilities . And in the process, we’ve raised the bar for all cloud-native application protection platform (CNAPP) solutions. With Security Command Center, you can now protect your Google Cloud and AWS cloud environments. Support for Azure is planned for summer 2024. Just released: SCC Enterprise documentation and release notes SCC Enterprise pricing information

56
vaskenh
Staff
K
kallenNew Member
posted in Security Command Center
Web Security Scanner fails with "An internal error occurred during the scan"

Our web scans stopped working. I'm not sure when, but I'm trying to debug. SCC is set to premium tier on the project. Web scanner is enabled. When I run the scan, I get "An internal error occurred during the scan. If the error continues, contact support." I know that the username and password work on this test.The only decent debug info I have is from Cloud Logging. I see a lot of 'resource not found' errors in the log. What are these errors about? There are 18 of them during my scan timeframe. Here are some examples: "Resource "projects/PROJECT_ID/rapidVulnerabilityDetectionSettings" (Type: "rapidVulnerabilityDetectionSettings") Not Found: "\\"projects/PROJECT_ID/rapidVulnerabilityDetectionSettings\\" not found"" "Resource "projects/PROJECT_ID/virtualMachineThreatDetectionSettings" (Type: "virtualMachineThreatDetectionSettings") Not Found: "\\"projects/PROJECT_ID/virtualMachineThreatDetectionSettings\\" not found""  Thanks in advance!

04
P
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Quick Guide - View Attack Surface Management findings in SCCE

This is a quick overview of how to review findings sourced by Attack Surface Management (ASM) in Security Command Center Enterprise (SCCE). First, let's see ASM findings in the greater context of all other SCCE data sources.  From the SCCE navigation window on the left, select Sources.  The resulting screen will list SCCE findings by data source.  By scrolling down, we can see that Attack Surface Management is one of the available data sources, and that there are associated findings that ASM has returned.  Clicking one of these findings will redirect you to the associated entry under Findings. Another way to review findings from ASM in SCCE is to use the available filters while already investigating in the Findings view.  Select Findings, then scroll down and note the available options in the Source display name filter. To read more about how Attack Surface Management (ASM) fits into the Google SecOps and SCCE as a whole, read this community post from @andra

10
vaskenh
Staff
A
Staff
andras11Staff
posted in Security Command Center
AWS threat and vulnerability detection in SCCE

Today's enterprises rarely rely on a single cloud provider. Hybrid and multi-cloud strategies have become the norm, offering flexibility and avoiding vendor lock-in. However, this diversity can make security management complex. Google Cloud's multi-cloud security initiatives aim to address this challenge head-on. You can now connect Security Command Center to Amazon Web Services for the following capabilities: Detect threats and vulnerabilities Assess the risk exposure of your high-value AWS resources Assess compliance with security standards Connect to AWS for threat detection Certain threat investigation capabilities in the Enterprise tier of Security Command Center are powered by Google Security Operations, including curated detections which enable you to identify patterns in both Google Cloud and AWS data. If you plan to use curated detections, make sure to review information about supported log types. Each rule set requires certain data to function as designed, including one or

21
vaskenh
Staff
M
MurugesanNew Member
asked in Security Command Center
An unused permission removal through security center remediation suggestion

Security command center reported the vulnerability " An unused permission" on user and service account and suggested to remediate accordingly to the IAM recommender. On the popup window, there IAM recommender suggested to remove the unused and  granted offending permission and add the less privilege roles to the user and service account. After removing the overly granted permission, the scan dashboard still shows the vulnerabilities.  Also to be sure on removing the role and binding to the service accounts and user, verified the user permission in the IAM and as well as gcloud command, it all confirming the excess and unused permission has been removed but security command center still stays or reporting the same case.

03
N
Staff
T
tickoonNew Member
posted in Security Command Center
Activate Security Command Center programatically

Hi,Can someone one confirm if it is possible to activate the product security command center with Standard or Premium tier programatically. Not talking about the service api securitycenter.googleapis.com but the actual SCC product. Enabling the securitycenter.googleapis.com service seems to have no impact on the product activation. Is there a way to have this activated through an API? I can only see documentation on how to do it from the web console/gcp scc product page (screenshot below). Is it also possible to use an api to see if this product is activated? Thanks

01
J
A
Staff
andras11Staff
posted in Security Command Center
Mastering Google Cloud Security Command Center Premium - Success Kit

Embarking on your cloud journey with Google Cloud Platform? Congratulations! The power and scalability of GCP are at your fingertips. But amidst the excitement, we understand the paramount importance of securing your cloud environment. That's where Google Cloud Security Command Center Premium (SCCP) steps in, and we're here to make your SCCP onboarding seamless and effective. Introducing Your Security Command Center Success Kit We've crafted a set of resources to guide you through every step of your Security Command Center Premium onboarding and utilization. These articles cover the essential topics you need to get started with SCCP: Onboarding: Your starting point for a successful SCC implementation. This guide walks you through the initial setup, configuration, and key features of Security Command Center, ensuring you get off on the right foot. Integrated Services: Learn how to leverage the power of integrated services within SCC. Understand how these integrations enrich your securi

00
A
Staff
A
Staff
andras11Staff
posted in Security Command Center
Mandiant Attack Surface Management + Google Security Command Center Enterprise

Google Cloud is taking a massive leap forward in cloud security by integrating Mandiant's Attack Surface Management (ASM) capabilities into the Enterprise Tier of its Security Command Center (SCC). Let's explore what this means for anyone seeking to fortify their cloud environments. What is Mandiant Attack Surface Management? Mandiant Attack Surface Management is a cybersecurity solution that continuously discovers, analyzes, and prioritizes an organization's internet-facing vulnerabilities from the attacker's point of view, helping to reduce the risk of breaches. Think of it as your digital perimeter's vigilant watchdog: Continuous Discovery: It relentlessly scans your entire Cloud Asset Inventory. Exposure Quantification: ASM goes beyond simple identification. It analyzes and prioritizes discovered vulnerabilities based on their potential severity and ease of exploitation, giving you a data-driven roadmap for remediation. Risk-Based Prioritization: Mandiant's ASM guides you to focus

10
A
Staff
T
tommy2386New Member
posted in Security Command Center
looking a way to re scan Security Health Analytics in gcp after we change firewall settings

We are looking for a way to re scan Security Health Analytics in gcp after we change firewall settings to fix the vulnerabilities.  It says its automatic but are we supposed to wait hours or days to see if our change eliminated the vuln.  this is a backup to our knowledge. We are unsure of how to proceed.

21
M
lnhymon
Staff
lnhymonStaff
posted in Security Command Center
Optimizing Security Command Center Premium

How do I optimize my SCC Configuration? The Security Command Center Premium (SCCP) Guide for Optimization exercise allows for verification of SCC enablement in an existing subscriber environment. This guided health check allows for verification of: Enablement of SCC Premium Tier services Access Control Best Practices / Least Privilege implementation Logging with SCCP Event Threat Detection Essential Security Contacts and Notifications Getting Started Simply outline your Goals and view the linked guide. As you progress through the steps, you’ll familiarize yourself with SCCP Premium services, such as:  Event Threat Detection Security Health Analytics Web Security Scanner Container Threat Detection Rapid vulnerability Detection Virtual Machine Threat Detection You will optimize threat detection capabilities by enabling robust logging in GCP, to include Firewall Rules, Workspace Login Audits, VPC Flow Log and more. Lastly, the guide will walk you through configuring SCCP Integrat

13
N
Staff
A
Staff
andras11Staff
posted in Security Command Center
Getting Started with SCC Enterprise - New Digital Learning Content

Our new learning module built around Security Command Center Enterprise is now live on our online learning platform! This course provides a comprehensive overview of Google Cloud Security Command Center (SCC) Enterprise, a Cloud-Native Application Protection Platform (CNAPP) solution that helps organizations prevent, detect, and respond to threats across Google Cloud services. You will learn about core SCC Enterprise features, including enhanced threat detection, in-depth vulnerability management, and integrated case management. Fundamental concepts in threat management and vulnerability assessment will also be covered, along with practical demonstrations of how to use SCC Enterprise to identify, investigate, and remediate security risks within your multi-cloud environment. When you complete this course, you can earn the badge displayed here!  Boost your cloud career by showing the world the skills you have developed! The course contains 3 individual modules and labs and takes ar

01
M
atul_shal
atul_shalBronze 2
posted in Security Command Center
Pub-Sub to Splunk using Dataflow

Is there any article /guide on how to update this? This is from dataflow job for pubsub to splunk -Log ingestion. Checking on Learn More link, I didn't find anything useful.    

23
N
Staff
A
Staff
andras11Staff
posted in Security Command Center
By Your Powers Combined! SCC and Chronicle SIEM Form a Cloud Security Captain Planet

Security Command Center (SCC) and Chronicle Security Information and Event Management (SIEM) are two powerful security tools that can significantly enhance an organization's security posture. When integrated, these products offer a comprehensive and unified view of an organization's security telemetry, enabling more effective threat detection, investigation, and response. Benefits of Integrating Google SCC and Chronicle SIEM Unified Security Visibility: Provides a single pane of glass for viewing all security telemetry, including alerts, events, and investigations, from both SCC and Chronicle SIEM and the rest of your infrastructure and security data reporting to your SIEM. Enhances situational awareness for security analysts, enabling them to quickly identify and respond to threats across the organization's entire security environment. Enhanced Threat Detection: Security analysts can use the integrated platform to proactively hunt for threats across the entire security environment

11
D
Staff
N
Nick_TroutiniBronze 5
posted in Security Command Center
Getting Started with Security Command Center: Your quickstart guide to risk management

Security Command Center is Google’s cloud-based security platform that helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities, and threats; and helping you mitigate and remediate risks. In this video, Program Manager Nick Troutini, provides Security Command Center users the information and resources you need to quickly gain cloud security confidence, stay up-to-date with the latest product updates, and find support when you need it.  You can use the timestamp links to quickly navigate to topics in the video that you’re interested in learning more about:  01:06 Where to find self-service support resources: documentation, events, and community 02:03 How to access Security Command Center documentation and guides 02:37 How to get help with your technical questions or issues: reaching Google Cloud support 03:20 Getting Started with Security Command Cent

22
Ray_a
Staff
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Using Event Threat Detection to Detect VMs in Unauthorized Regions

In this community post, we’ll take a closer look at Event Threat Detection (ETD) in Security Command Center Premium, with a focus on the ability for customers to create custom ETD modules. SCC Premium provides a framework for creating custom modules for ETD using module templates.  In this post, we’ll take a closer look at using one of these templates to create a finding that is triggered when a user provisions a virtual machine in an unauthorized GCP region. In Google Cloud, a region is a geographical location that can host resources.  Regions are further divided into distinct deployment areas called zones, which ensures infrastructure redundancy within the context of a region.   In GCP, resources that reside in a specific region, like compute instance VMs, are called regional resources. SCC Premium administrators have the ability to detect the provisioning of VMs in specific regions and to trigger a finding based on that activity.  Let’s take a closer look at how

00
vaskenh
Staff
S
Staff
scottennisStaff
posted in Security Command Center
New Google Cloud Security Customer Success Services Available!

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

00
S
Staff
A
Staff
andras11Staff
posted in Security Command Center
Mapping MITRE ATT&CK Techniques to SCC Findings: Detecting and Mitigating Resource Hijacking - T1496

The MITRE ATT&CK framework provides an invaluable structure for understanding the tactics, techniques, and procedures (TTPs) used by advanced threat actors. Security Command Center (SCC), Google Cloud's security and risk management platform, offers robust capabilities for detecting and mitigating these threats. In this post, we'll delve into how to map the MITRE ATT&CK technique of Resource Hijacking (T1496) to SCC findings, potentially augmented with Google Chronicle for enhanced visibility. Understanding Resource Hijacking (T1496) Resource hijacking involves adversaries targeting publicly exposed resources to exploit for malicious purposes. A common example is cryptojacking, where attackers compromise systems to illicitly mine cryptocurrency using the victim's computing power. The Power of SCC: Detection and Response Security Command Center helps identify and respond to resource hijacking attempts in several ways: Misconfigured Instance Findings: SCC scans for publicly expos

10
A
Staff
A
Staff
andras11Staff
posted in Security Command Center
SCC as a Data Lake - Leveraging BigQuery for Advanced Security Analytics

Let's face it, Security Command Center (SCC) is a goldmine of security data. But sometimes, those shiny nuggets of insight need a bit of refining before they reveal their true value. That's where BigQuery comes in, transforming your SCC data into a powerful data lake for supercharged security analytics. Why SCC + BigQuery = A Security Analyst's Dream Long-term Retention: Exporting findings to BigQuery provides a comprehensive repository for investigating security events over time. Custom Queries with a Vengeance: Go beyond SCC's built-in searches. BigQuery lets you unleash your inner SQL ninja to hunt down threats like a true cyber-warrior. Trend Analysis and Visualization: Identify patterns, anomalies, and recurring incidents by analyzing large volumes of SCC data within BigQuery. Easily visualize these insights for better decision-making. Let's Get Practical! SCC Data Export: We are not going into too much details on the initial configuration itself as this is already documented at

20
A
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.