Skip to main content

Security Command Center

Questions about Security Command Center? You've come to the right place. Connect with other SCC users, discuss best practices, overcome challenges.

  • 62 Topics
  • 106 Replies
62 Topics
kaushik853
kaushik853Bronze 1
posted in Security Command Center
GKE security posture finding

Hi Team, Is the GKE security posture findings are integrated with Security command center(SCC) findings?

03
H
Staff
B
bhaskarsNew Member
posted in Security Command Center
Unable to export (donwload) the complete columns in SCC finding options.

Team, Please let me know how to download the complete report (all findings) in the security command center.  Even I have added columns for more information. I can see the webpage and those values do not appear if i export the csv report.   Could you please someone test and let me know if i need to change any value to download the complete report

04
H
Staff
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Creating custom Event Threat Detection modules in SCC Premium

In this community post, we’ll take a closer look at creating custom modules for Event Threat Detection (ETD) in Security Command Center Premium. SCC Premium provides a framework for creating custom modules for ETD using module templates. As an example, we’ll explain how to use the Domains template to craft a custom ETD module to detect communication with a command-and-control (C2) domain associated with the WARPWIRE credential harvester. In a January 11 blog post, Mandiant researchers detailed a family of malware associated with two disclosed vulnerabilities affecting Ivanti Connect Secure VPN and Ivanti Policy Secure appliances.  Multiple indicators of compromise (IOCs) are detailed in the research, including a network-based indicator for a domain that serves as the C2 destination for a Javascript-based credential harvester called WARPWIRE. It’s important to note that SCC Premium already integrates the latest Mandiant Threat Intelligence into Event Threat Detection without any ex

10
vaskenh
Staff
S
Staff
scottennisStaff
posted in Security Command Center
Join our Webinar: Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up. 

00
S
Staff
A
Staff
andras11Staff
posted in Security Command Center
Policy Controller Integration with SCC

The integration of Policy Controller for Kubernetes clusters with Security Command Center is now released to General Availability. Policy Controller enables the application and enforcement of programmable policies for your Kubernetes clusters. These policies act as guardrails and can help with best practices, security, and compliance management of your clusters and fleet.Policy Controller is fully integrated with Google Cloud, includes a built-in dashboard, for observability, and comes with a full library of pre-built policies for common security and compliance controls Policy Controller can operate as: Detective Control: Identify policy violations and send these Findings to SCC Preventive Control: Stop deployments outside of your configured compliance. If you install Policy Controller and enable either the CIS Kubernetes Benchmark v1.5.1 or the PCI-DSS v3.2.1 Policy Controller bundles, or both, Policy Controller automatically writes cluster violations to Security Command Center Prem

10
A
Staff
A
Staff
andras11Staff
posted in Security Command Center
Get your Skill Badge for Security Command Center!

You can now find some great SCC-related learning modules on Google Cloud Skills Boost Earn a skill badge by completing the Mitigate Threats and Vulnerabilities with Security Command Center quest, where you will learn how to prevent and manage environment threats, identify and mitigate application vulnerabilities, respond to security anomalies, and a whole lot more. This learning quest is a perfect opportunity for first time users to get some more hands-on experience and gain confidence using SCC for security investigations and configurations. The quest contains 5 individual modules and labs and takes around 6 hours to complete. Getting Started with Security Command Center Explore SCC interface elements. Configure SCC settings at the project level. Analyze and fix SCC vulnerability findings. Analyzing Findings with Security Command Center Create a continuous export pipeline to Pub/Sub. Export and analyze SCC findings with BigQuery. Identify Application Vulnerabilities with Security

00
A
Staff
A
Staff
andras11Staff
posted in Security Command Center
How to easily differentiate between different classes of Findings in SCC?

SCC comes with a wealth of security monitors, threat detection rules and tools to check for vulnerabilities and misconfigurations. Resources, architecture and configuration will differ per organization (or even per project) and there’s no ‘one fits all’ way to manage and categorize these findings; however I’ve found the table below a useful guide for these detector classes when discussing or working with different GCP environments. Hope you find this useful on your security journey with SCC and if you have any questions or comments please feel free to add to this post.  * For Misconfigurations we would normally recommend using a filter to concentrate on high and critical priorities to start with to avoid findings overload ** There’s another Class which we not included in the table: Finding class unspecified class Findings in the Finding class unspecified class either do not have a value specified on the findingClass property or do not include the property at all

01
T
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Detecting suspicious service account behavior with SCC Premium

In this community post, we’ll take a closer look at detecting suspicious service account behavior in Google Cloud using SCC Premium.   Service accounts are commonly leveraged by attackers to establish a foothold in cloud environments as part of an attack scenario.  Compromised service accounts can exhibit suspicious activity in a number of ways.  Our research has identified attackers who gain access to compromised service accounts will enumerate the IAM roles and permissions associated with that account to understand their ability to move laterally within an environment.  Doing so establishes potential next steps in leveraging the account for future malicious activity. In this scenario, we’ll use a VM Instance in GCP to manually trigger a finding in SCC Premium related to service account self-investigation.  We’ll cover the required configuration needed to trigger this finding, then execute a gcloud command from the system using the default service account

00
vaskenh
Staff
S
seeinNew Member
posted in Security Command Center
Error while download CSV after exporting Security Command Center (SCC) findings

Hi, At the beginning of this week im facing problem while downloading CSV file after export SCC findings to CSV. Export already complete then i try to download: The errors:   I already try to clear all cookies and change to another browser and another devices but still facing this issues.

33
L
Staff
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Security Command Center Premium now operationalizes Mandiant Threat Intelligence!

Event Threat Detection (ETD) findings in SCC Premium now leverage IOCs derived from Mandiant’s frontline incident response and threat intelligence.   SCC Premium customers automatically take advantage of this coverage without making any changes. By integrating these IOCs into SCC Premium, customers automatically get broader coverage for existing ETD rules like: Malware: Bad IP Malware: Bad Domain  Malware: Bad Cryptomining IP Malware: Bad Cryptomining Domain  Evasion: Access from Anonymizing Proxy ETD offers a broad range of rules to detect suspicious activity in your GCP environment.  By ingesting flow logs and DNS queries, ETD rules detect communication with malicious IPs or domains.  ETD rules also detect other suspicious behavior like communication with cryptomining infrastructure or anonymizing proxies.  With Mandiant Threat Intelligence now integrated into SCC Premium, the coverage of these findings is expanded. In a future post, we will instr

00
vaskenh
Staff
P
pfilourencoBronze 2
asked in Security Command Center
SCC - Attack path simulation using SA SYSTEM_MANAGED Keys

Hi, Attack path simulation is using SA SYSTEM_MANAGED keys to represent as a possibility, this is something that we as user's can't do anything, since any SA without USER_MANAGED key have always a SYSTEM_MANAGED key. Is this something expected?  Any solution to avoid this keys on the simulation?   BR, Pedro Lourenço

02
P
A
arunkumarjcaNew Member
posted in Security Command Center
SCC alerts

Hello Team, Do we have any option to mute the SCC alerts for list  of users who are not enforced MFA in a specific organisation units.? Thanks in advance Regards, Arun

01
D

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.