Security Command Center

In this community post, we’ll take a closer look at Event Threat Detection (ETD) in Security Command Center Premium, with a focus on the ability for customers to create custom ETD modules. SCC Premium provides a framework for creating custom modules for ETD using module templates.  In this post, we’ll take a closer look at using one of these templates to create a finding that is triggered when a user provisions a virtual machine in an unauthorized GCP region. In Google Cloud, a region is a geographical location that can host resources.  Regions are further divided into distinct deployment areas called zones, which ensures infrastructure redundancy within the context of a region.   In GCP, resources that reside in a specific region, like compute instance VMs, are called regional resources. SCC Premium administrators have the ability to detect the provisioning of VMs in specific regions and to trigger a finding based on that activity.  Let’s take a closer look at how

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

The MITRE ATT&CK framework provides an invaluable structure for understanding the tactics, techniques, and procedures (TTPs) used by advanced threat actors. Security Command Center (SCC), Google Cloud's security and risk management platform, offers robust capabilities for detecting and mitigating these threats. In this post, we'll delve into how to map the MITRE ATT&CK technique of Resource Hijacking (T1496) to SCC findings, potentially augmented with Google Chronicle for enhanced visibility. Understanding Resource Hijacking (T1496) Resource hijacking involves adversaries targeting publicly exposed resources to exploit for malicious purposes. A common example is cryptojacking, where attackers compromise systems to illicitly mine cryptocurrency using the victim's computing power. The Power of SCC: Detection and Response Security Command Center helps identify and respond to resource hijacking attempts in several ways: Misconfigured Instance Findings: SCC scans for publicly expos

Let's face it, Security Command Center (SCC) is a goldmine of security data. But sometimes, those shiny nuggets of insight need a bit of refining before they reveal their true value. That's where BigQuery comes in, transforming your SCC data into a powerful data lake for supercharged security analytics. Why SCC + BigQuery = A Security Analyst's Dream Long-term Retention: Exporting findings to BigQuery provides a comprehensive repository for investigating security events over time. Custom Queries with a Vengeance: Go beyond SCC's built-in searches. BigQuery lets you unleash your inner SQL ninja to hunt down threats like a true cyber-warrior. Trend Analysis and Visualization: Identify patterns, anomalies, and recurring incidents by analyzing large volumes of SCC data within BigQuery. Easily visualize these insights for better decision-making. Let's Get Practical! SCC Data Export: We are not going into too much details on the initial configuration itself as this is already documented at

Hi Team, Is the GKE security posture findings are integrated with Security command center(SCC) findings?

Team, Please let me know how to download the complete report (all findings) in the security command center.  Even I have added columns for more information. I can see the webpage and those values do not appear if i export the csv report.   Could you please someone test and let me know if i need to change any value to download the complete report

In this community post, we’ll take a closer look at creating custom modules for Event Threat Detection (ETD) in Security Command Center Premium. SCC Premium provides a framework for creating custom modules for ETD using module templates. As an example, we’ll explain how to use the Domains template to craft a custom ETD module to detect communication with a command-and-control (C2) domain associated with the WARPWIRE credential harvester. In a January 11 blog post, Mandiant researchers detailed a family of malware associated with two disclosed vulnerabilities affecting Ivanti Connect Secure VPN and Ivanti Policy Secure appliances.  Multiple indicators of compromise (IOCs) are detailed in the research, including a network-based indicator for a domain that serves as the C2 destination for a Javascript-based credential harvester called WARPWIRE. It’s important to note that SCC Premium already integrates the latest Mandiant Threat Intelligence into Event Threat Detection without any ex

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up. 

The integration of Policy Controller for Kubernetes clusters with Security Command Center is now released to General Availability. Policy Controller enables the application and enforcement of programmable policies for your Kubernetes clusters. These policies act as guardrails and can help with best practices, security, and compliance management of your clusters and fleet.Policy Controller is fully integrated with Google Cloud, includes a built-in dashboard, for observability, and comes with a full library of pre-built policies for common security and compliance controls Policy Controller can operate as: Detective Control: Identify policy violations and send these Findings to SCC Preventive Control: Stop deployments outside of your configured compliance. If you install Policy Controller and enable either the CIS Kubernetes Benchmark v1.5.1 or the PCI-DSS v3.2.1 Policy Controller bundles, or both, Policy Controller automatically writes cluster violations to Security Command Center Prem

You can now find some great SCC-related learning modules on Google Cloud Skills Boost Earn a skill badge by completing the Mitigate Threats and Vulnerabilities with Security Command Center quest, where you will learn how to prevent and manage environment threats, identify and mitigate application vulnerabilities, respond to security anomalies, and a whole lot more. This learning quest is a perfect opportunity for first time users to get some more hands-on experience and gain confidence using SCC for security investigations and configurations. The quest contains 5 individual modules and labs and takes around 6 hours to complete. Getting Started with Security Command Center Explore SCC interface elements. Configure SCC settings at the project level. Analyze and fix SCC vulnerability findings. Analyzing Findings with Security Command Center Create a continuous export pipeline to Pub/Sub. Export and analyze SCC findings with BigQuery. Identify Application Vulnerabilities with Security

SCC comes with a wealth of security monitors, threat detection rules and tools to check for vulnerabilities and misconfigurations. Resources, architecture and configuration will differ per organization (or even per project) and there’s no ‘one fits all’ way to manage and categorize these findings; however I’ve found the table below a useful guide for these detector classes when discussing or working with different GCP environments. Hope you find this useful on your security journey with SCC and if you have any questions or comments please feel free to add to this post.  * For Misconfigurations we would normally recommend using a filter to concentrate on high and critical priorities to start with to avoid findings overload ** There’s another Class which we not included in the table: Finding class unspecified class Findings in the Finding class unspecified class either do not have a value specified on the findingClass property or do not include the property at all

In this community post, we’ll take a closer look at detecting suspicious service account behavior in Google Cloud using SCC Premium.   Service accounts are commonly leveraged by attackers to establish a foothold in cloud environments as part of an attack scenario.  Compromised service accounts can exhibit suspicious activity in a number of ways.  Our research has identified attackers who gain access to compromised service accounts will enumerate the IAM roles and permissions associated with that account to understand their ability to move laterally within an environment.  Doing so establishes potential next steps in leveraging the account for future malicious activity. In this scenario, we’ll use a VM Instance in GCP to manually trigger a finding in SCC Premium related to service account self-investigation.  We’ll cover the required configuration needed to trigger this finding, then execute a gcloud command from the system using the default service account

Hi, At the beginning of this week im facing problem while downloading CSV file after export SCC findings to CSV. Export already complete then i try to download: The errors:   I already try to clear all cookies and change to another browser and another devices but still facing this issues.

Event Threat Detection (ETD) findings in SCC Premium now leverage IOCs derived from Mandiant’s frontline incident response and threat intelligence.   SCC Premium customers automatically take advantage of this coverage without making any changes. By integrating these IOCs into SCC Premium, customers automatically get broader coverage for existing ETD rules like: Malware: Bad IP Malware: Bad Domain  Malware: Bad Cryptomining IP Malware: Bad Cryptomining Domain  Evasion: Access from Anonymizing Proxy ETD offers a broad range of rules to detect suspicious activity in your GCP environment.  By ingesting flow logs and DNS queries, ETD rules detect communication with malicious IPs or domains.  ETD rules also detect other suspicious behavior like communication with cryptomining infrastructure or anonymizing proxies.  With Mandiant Threat Intelligence now integrated into SCC Premium, the coverage of these findings is expanded. In a future post, we will instr

Hi, Attack path simulation is using SA SYSTEM_MANAGED keys to represent as a possibility, this is something that we as user's can't do anything, since any SA without USER_MANAGED key have always a SYSTEM_MANAGED key. Is this something expected?  Any solution to avoid this keys on the simulation?   BR, Pedro Lourenço

Hello Team, Do we have any option to mute the SCC alerts for list  of users who are not enforced MFA in a specific organisation units.? Thanks in advance Regards, Arun