Security Command Center

Security Command Center (SCC) and Chronicle Security Information and Event Management (SIEM) are two powerful security tools that can significantly enhance an organization's security posture. When integrated, these products offer a comprehensive and unified view of an organization's security telemetry, enabling more effective threat detection, investigation, and response. Benefits of Integrating Google SCC and Chronicle SIEM Unified Security Visibility: Provides a single pane of glass for viewing all security telemetry, including alerts, events, and investigations, from both SCC and Chronicle SIEM and the rest of your infrastructure and security data reporting to your SIEM. Enhances situational awareness for security analysts, enabling them to quickly ide

Security Command Center is Google’s cloud-based security platform that helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities, and threats; and helping you mitigate and remediate risks. In this video, Program Manager Nick Troutini, provides Security Command Center users the information and resources you need to quickly gain cloud security confidence, stay up-to-date with the latest product updates, and find support when you need it.  You can use the timestamp links to quickly navigate to topics in the video that you’re interested in learning more about:  01:06 Where to find self-service support resources:

In this community post, we’ll take a closer look at Event Threat Detection (ETD) in Security Command Center Premium, with a focus on the ability for customers to create custom ETD modules. SCC Premium provides a framework for creating custom modules for ETD using module templates.  In this post, we’ll take a closer look at using one of these templates to create a finding that is triggered when a user provisions a virtual machine in an unauthorized GCP region. In Google Cloud, a region is a geographical location that can host resources.  Regions are further divided into distinct deployment areas called zones, which ensures infrastructure redundancy within the context of a region.   In GCP, resources that reside in a specific region, like compute instance VMs, are called regional resources. SCC Premium administrators have the ability to detect th

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+

The MITRE ATT&CK framework provides an invaluable structure for understanding the tactics, techniques, and procedures (TTPs) used by advanced threat actors. Security Command Center (SCC), Google Cloud's security and risk management platform, offers robust capabilities for detecting and mitigating these threats. In this post, we'll delve into how to map the MITRE ATT&CK technique of Resource Hijacking (T1496) to SCC findings, potentially augmented with Google Chronicle for enhanced visibility. Understanding Resource Hijacking (T1496) Resource hijacking involves adversaries targeting publicly exposed resources to exploit for malicious purposes. A common example is cryptojacking, where attackers compromise systems to illicitly mine cryptocurrency using the victim's computing power. The Power of SCC: Detection and Response Security Command Center helps identify and respond to resource hijacking

Let's face it, Security Command Center (SCC) is a goldmine of security data. But sometimes, those shiny nuggets of insight need a bit of refining before they reveal their true value. That's where BigQuery comes in, transforming your SCC data into a powerful data lake for supercharged security analytics. Why SCC + BigQuery = A Security Analyst's Dream Long-term Retention: Exporting findings to BigQuery provides a comprehensive repository for investigating security events over time. Custom Queries with a Vengeance: Go beyond SCC's built-in searches. BigQuery lets you unleash your inner SQL ninja to hunt down threats like a true cyber-warrior. Trend Analysis and Visualization: Identify patterns, anomalies, and recurring incidents by analyzing large volumes of SCC data wi

Hi Team, Is the GKE security posture findings are integrated with Security command center(SCC) findings?

Team, Please let me know how to download the complete report (all findings) in the security command center.  Even I have added columns for more information. I can see the webpage and those values do not appear if i export the csv report.   Could you please someone test and let me know if i need to change any value to download the complete report

In this community post, we’ll take a closer look at creating custom modules for Event Threat Detection (ETD) in Security Command Center Premium. SCC Premium provides a framework for creating custom modules for ETD using module templates. As an example, we’ll explain how to use the Domains template to craft a custom ETD module to detect communication with a command-and-control (C2) domain associated with the WARPWIRE credential harvester. In a January 11 blog post, Mandiant researchers detailed a family of malware associated with two disclosed vulnerabilities affecting Ivanti Connect Secure VPN and Ivanti Policy Secure appliances.  Multiple indicators of compromise (IOCs) are detailed in the research, including a network-based indicator for a domain that ser

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up. 

The integration of Policy Controller for Kubernetes clusters with Security Command Center is now released to General Availability. Policy Controller enables the application and enforcement of programmable policies for your Kubernetes clusters. These policies act as guardrails and can help with best practices, security, and compliance management of your clusters and fleet.Policy Controller is fully integrated with Google Cloud, includes a built-in dashboard, for observability, and comes with a full library of pre-built policies for common security and compliance controls Policy Controller can operate as: Detective Control: Identify policy violations and send these Findings to SCC Preventive Control: Stop deployments outside of your configured compliance. If you install Po

You can now find some great SCC-related learning modules on Google Cloud Skills Boost Earn a skill badge by completing the Mitigate Threats and Vulnerabilities with Security Command Center quest, where you will learn how to prevent and manage environment threats, identify and mitigate application vulnerabilities, respond to security anomalies, and a whole lot more. This learning quest is a perfect opportunity for first time users to get some more hands-on experience and gain confidence using SCC for security investigations and configurations. The quest contains 5 individual modules and labs and takes around 6 hours to complete. Getting Started with Security Command Center Explore SC

SCC comes with a wealth of security monitors, threat detection rules and tools to check for vulnerabilities and misconfigurations. Resources, architecture and configuration will differ per organization (or even per project) and there’s no ‘one fits all’ way to manage and categorize these findings; however I’ve found the table below a useful guide for these detector classes when discussing or working with different GCP environments. Hope you find this useful on your security journey with SCC and if you have any questions or comments please feel free to add to this post.  * For Misconfigurations we would normally recommend using a filter to concentrate on high and critical priorities to start with to avoid findings overload ** There’s another Class which we not included in the t

In this community post, we’ll take a closer look at detecting suspicious service account behavior in Google Cloud using SCC Premium.   Service accounts are commonly leveraged by attackers to establish a foothold in cloud environments as part of an attack scenario.  Compromised service accounts can exhibit suspicious activity in a number of ways.  Our research has identified attackers who gain access to compromised service accounts will enumerate the IAM roles and permissions associated with that account to understand their ability to move laterally within an environment.  Doing so establishes potential next steps in leveraging the account for future malicious activity. In this scenario, we’ll use a VM Instance in GCP to manually trigger a finding in SCC Premium related to service account self-investigation.  We’ll cover the required configuration needed to trigger this finding, then execute a

Hi, At the beginning of this week im facing problem while downloading CSV file after export SCC findings to CSV. Export already complete then i try to download: The errors:   I already try to clear all cookies and change to another browser and another devices but still facing this issues.

Event Threat Detection (ETD) findings in SCC Premium now leverage IOCs derived from Mandiant’s frontline incident response and threat intelligence.   SCC Premium customers automatically take advantage of this coverage without making any changes. By integrating these IOCs into SCC Premium, customers automatically get broader coverage for existing ETD rules like: Malware: Bad IP Malware: Bad Domain  Malware: Bad Cryptomining IP Malware: Bad Cryptomining Domain  Evasion: Access from Anonymizing Proxy ETD offers a broad range of rules to detect suspicious activity in your GCP environment.  By inge

Hi, Attack path simulation is using SA SYSTEM_MANAGED keys to represent as a possibility, this is something that we as user's can't do anything, since any SA without USER_MANAGED key have always a SYSTEM_MANAGED key. Is this something expected?  Any solution to avoid this keys on the simulation?   BR, Pedro Lourenço

Hello Team, Do we have any option to mute the SCC alerts for list  of users who are not enforced MFA in a specific organisation units.? Thanks in advance Regards, Arun