Skip to main content
Menu

Security Command Center

Questions about Security Command Center? You've come to the right place. Connect with other SCC users, discuss best practices, overcome challenges.

  • 62 Topics
  • 110 Replies
62 Topics
EJJesse
EJJesseNew Member
posted in Security Command Center
Web Security Scanner authentication failure during actual scan

I'm trying to setup up Web Security Scanner with non-Google account for authorisation. I have a simplified login form that works as expected when saving the scan details, and I can see in our server login it's requesting the page, submitting the form, receiving the cookie, and then viewing the post-login page successfully.However when I try to run the scan it is always return a Login procedure failed error. Checking the logs I can see it's still visiting the sign in page, however no POST requests are being made. This includes both the post for the submit form, and another POST request that runs on page load. Both are called when the scan settings are being saved and verified however.I can see the login form submit is definitely triggering. From reading the documentation I can see custom scans should support POST requests, on managed scans are GET only. We are using the standard tier so these scans can only be custom scans.I've testing using alternate User Agents with no success. Is the

322
EJJesse
Sahil-Rakhyani
Sahil-RakhyaniNew Member
posted in Security Command Center
Container Image vulnerabilities ||

Hello Guys, I am able to see many container image vulnerabilities in our environment. The occurrences are from artifact registry.We have fixed from 156 vulnerabilities to 22 and deleted the older digests as well.But in Risk overview -> Findings -> I am still able to see the older digests vulnerabilities that have already been fixed. When I click them it shows not found (That confirms it was deleted) but in findings tab it still retains the count.Why doesn't the count gets refreshed? We have tried manual artifact image scanning using Gcloud artifact scanner and also tried pushing the image again for refreshing still its not working. Any solution ?

492
Sahil-Rakhyani
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Using Security Marks in Security Command Center

  Security Marks are a unique concept in Security Command Center.  They allow us to annotate assets or findings in SCC with additional business context.  You can apply Security Marks to both Assets and Findings. To apply Security Marks, you'll need one or both of the following permissions depending on whether you'll be applying Security Marks to assets, to findings, or both. For Asset Security Marks: Asset Security Marks Writer, securitycenter.assetSecurityMarksWriter For Finding Security Marks: Finding Security Marks Writer, securitycenter.findingSecurityMarksWriter You can add a Security Mark to an asset by navigating to the Assets view in Security Command Center and then selecting one or more assets.  Click the Set Security Marks button. Security Marks take the form of key-value pairs.  Here is an example of configuring a Security Mark to add the key/value pair of stage/prod to an asset. To learn more about Security Marks in Security

423
hnguyen123
ScienceCat
Staff
ScienceCatStaff
posted in Security Command Center
Model Armor Learning Lab: Released

Hello Security Engineers\\Operators\\AnalystsGoogle Cloud Learning Services has launched a new lab for Model Armor.  This lab will cover the basics of getting started with Model Armor and walks you through initial steps for working with the product. Get used to configuration and responses from within the product set while learning how you might implement it for your own applications or agents. Find our new lab at the link below. Sanitize Prompts and Responses with Model Armor  Do you want to know more details? Model Armor on Google Cloud Platform enhances AI safety by screening both user prompts and LLM responses for risks like harmful content, prompt injection, and sensitive data leaks. It allows organizations to centrally manage and enforce security policies for their AI applications, acting as a filter to ensure interactions are safe and compliant. This service integrates with Security Command Center for unified visibility and helps protect against unauthorized exposure or

765
M
andras11
Staff
andras11Staff
posted in Security Command Center
How Risk Engine detects toxic combinations

Please note at the time of this post the Toxic Combinations feature is currently in Preview. A toxic combination is a group of security issues that, when they occur together in a particular pattern, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources. A security issue is anything that contributes to the exposure of your cloud resources, such as a particular configuration of resources, a misconfiguration, or a software vulnerability. The Risk Engine of Security Command Center Enterprise detects toxic combinations during the attack path simulations it runs. For each toxic combination that Risk Engine detects, it issues a finding. Each finding includes an attack exposure score that measures the risk of the toxic combination to the high-value resources in your cloud environment. Risk Engine also generates a visualization of the attack path that the toxic combination creates to the high-value reso

192
vaskenh
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Security Command Center
Container Threat Detection (KTD) - VirusTotal-Hash Links

How does it work? Hash Generation: The system generates hashes for process binary data. VirusTotal (VT) Query: Hashes are used to construct VT links and query the VT database. Link Retrieval: VT link is retrieved and displayed alongside corresponding findings. Risk Assessment: Quickly assess risk based on VT reputation data (e.g., benign, suspicious, malicious). Does customers need a VirusTotal License?VirusTotal License are not required to leverage this feature. Are we leveraging VT data when rating the severity of the finding (ex positive match = high / critical, no match at all = low or something like that) We are not leveraging VT data to rate the severity of the findings. 

20
rafaelramirez
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Security Command Center
Virtual Machine Threat Detection - AWS Malware Disk Scan

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.What it does? Create and scan short-lived snapshots of Linux-and Windows-based Virtual Machines for malware without disrupting the workloads.  Analyzes executables on the VM for known malware signatures. Detected findings are reported to Google SCC. Enabling VM Threat Detection for AWS  Confirm AWS Connector: Ensure Security Command Center is connected to your AWS environment. Enable VM Threat Detection: Activate the feature within Security Command Center. Deploy CloudFormation Template: Deploy the provided template in your AWS accounts.   Further information:  https://cloud.google.com/security-command-center/docs/concepts-vm-threat-detection-overview#multicloud-features    

10
rafaelramirez
Staff
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Enhancing Google Cloud protection: 4 new capabilities in Security Command Center

On June 4, we posted a blog highlighting new features in Security Command Center (SCC) and Security Command Center Enterprise (SCCE). One of the cool new features available to customers is an integration with the Artifact Analysis component of Artifact Registry.  To learn more about this new integration as well as other new developments like agentless scanning for Google Cloud Compute and Google Kubernetes Engine (GKE), check out the below link to the full blog! https://cloud.google.com/blog/products/identity-security/enhancing-protection-4-new-security-command-center-capabilities

80
vaskenh
Staff
A
Avish_gargBronze 1
asked in Security Command Center
SecOps integration with PageDuty

Hello,We are looking for the process to integrate SecOps with PagerDuty. Is there any process documentation available.Thanks

281
a_aleinikov
L
lfernandezNew Member
posted in Security Command Center
Hello Comunity

Has anyone implemented Security Command Center Enterprise? Do you know the billing model?

01
vaskenh
Staff
D
DanLLNew Member
posted in Security Command Center
Extension Installation Denied

Trying to install an extension I get a message saying something like my admin  policy won't allow the installation. I've been trying to do something about this for some time to no avail. If this is the wrong place to ask this question I apologize.

11
AaronR
Staff
R
RickaNew Member
posted in Security Command Center
Web Security Scanner fails to authenticate (Non-Google account)

I have been trying to create a new Scan with "Non-Google account" authentication for a while and always fails with a FAILED_TO_AUTHENTICATE_TO_TARGET error code.According to the documentation, the possible issues could be:Using non-standard HTML form fields, for example, not using a password type.Using a complicated login form, for example, a form that has more than a single username and password field.Not saving an authentication cookie on successful login.In some situations, the scanner is denied by counter-measures that are meant to protect against bots, DDOS, and other attacks.I can confirm that a simple form is being used, it has no more that a single username and password field, a cookie is created after a successful login and the scanner is not denied access in any form.Moreover, checking the application logs I can confirm that the Web Security Scan is able to login and a session cookie is created, but I'm still receiving a FAILED_TO_AUTHE

34
andras11
Staff
AfvanJaffer
AfvanJafferBronze 5
asked in Security Command Center
Abuseevent logs from GCP

Hi Folks!,Can anyone clarify what the logs from abuseevent.googleapis.com in GCP represent?The name gives some indication, but I'd like to know how to enable them.Is there any documentation available that explains this in detail?

11
andras11
Staff
G
Staff
GregMStaff
posted in Security Command Center
What’s New in Security Command Center?

What’s New in Security Command Center? This Seurity Command Center product release digest is designed to keep you informed about the latest advancements in SCC Enterprise and SCC Premium. Discover the latest cloud security capabilities that we made available in Q3 2024.__________________________________________________________________________________ Get expanded CIEM support for additional clouds and identity providers (Generally Available)   Security Command Center now supports AWS IAM identities for AWS, and Entra ID (Azure AD) and Okta identities on Google Cloud. With multicloud, multi-identity CIEM support, it’s easier to discover which identities have access to which cloud resources across more of your cloud footprint. All new capabilities are available in SCC Enterprise.Read our blog >> Read SCC documentation >>     Use toxic combinations pinpoint your greatest cloud risks  (Public Preview) Security Command Center’s virtual red team capability no

71
R
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
How to view existing Continuous Exports in SCC

In this brief post, I'll show you how to view the list of Continuous Exports that have been defined in Security Command Center.   Continuous Exports allow SCC to send Findings that match a given query to some external destination, like a Pub/Sub topic.  In some cases, you might want to view the existing configuration for Continuous Exports that have been defined, like for the purpose of verifying what the associated query consists of. In SCC, you can access the list of existing continuous exports by navigating to Risk Overview >  Settings, and then clicking the Continuous Exports tab.   In the subsequent screen, you'll see a list of configurations associated with each Continuous Export defined in SCC.

80
vaskenh
Staff
S
subrahmanyam425New Member
posted in Security Command Center
Top CVE findings on your virtual machines

Hi,I am facing issue with Security Command Center(RiskOverview) page and given detailed steps as below.I have permissions for Security Command Center(SCC) with "Enterprise" at Organization level and  "Premium" at Project level. But I could not be able to see any information in "RiskOver" page for  "Top CVE findings on your virtual machines". I have gone through various SCC documentations and changed IAM permissions for my account to see the information for  "Top CVE findings on your virtual machines".After trying a lot of ways, I came to here for a solution. Please suggest how to proceed further and if any other information is required from myside, please let me know. I will provide the required information.Thanks and regards,Subrahmanyam

65
andras11
Staff
F
FrandleeNew Member
asked in Security Command Center
any document about vulnerabilities without module ID on SCC?

Hi experts, I am trying to understand the items list on the Vulneraibilities of SCC. There are a lot of items that have no Module ID in the Vulneraibilities page. For example, Cataegory: GKE Security bulletin, Secrets in environment variables, block all ingress. Is there any documents about these items without Module id?Many thanks. BR,Lee 

42
F
rahul7514
rahul7514Bronze 2
posted in Security Command Center
Migration from premium to enterprise

Hi Recently one of my clients said  that they r planning to migrate from premium to enterprise edition and requested us to onboard it in SOAR. I have couple of questions, not sure if this is the right place1) in terms of integrating  with SOAR , is there going to be any changes , we have sccp currently fed to secops soar. Does it require new integration. 2) in terms of playbooks that exists for sccp , do we need to also make changes in that. 3) would there be new findings which were not previously seen in sccp.  

33
vaskenh
Staff
D
dheerajpanyamBronze 4
posted in Security Command Center
SCC premium does not work with Firebase?? Interesting

We did all the hard work in setting up a GCP org , moving all standalone projects under the Org just to run SCC premium scan on our App and guess what??? Our App is deployed across Firebase hosting (for front end)  and also on GKE (for backend) . When i tried to setup web security answer , i got error below seems like a lot of restrictions with static IP etc just to run the scans . Firebase is also from Google if i am not wrong. Is there no way to run scan for my App?

44
D
V
vamsi_nrvNew Member
posted in Security Command Center
GCP Security Command Center (Premium) vs Prisma Cloud

Dear Community,We are contemplating enabling GCP Security Command Center premium version at Org level. At the same time we are using Prima for vulnerability.Now the question i have is, how do we do trade off between the 2 tool in terms of  features, pricing, ease of use etc to present a case for management?Our Org has multi cloud strategy and we have AWS & Azure as well. Prima being cloud native is one advantage over SCC any other pointers you can provide to determine the same?Thank you!

163
A
Staff
D
dheerajpanyamBronze 4
posted in Security Command Center
SCC + Chronicle SIEM + Chronicle SOAR - How are they connected?

I would like to understand how the trio - SCC , Chronicle SIEM and Chronicle SOAR are connected. A-la-carte versions versus completed connected solution - Looking for a comparison.SCC = Security Command Center

82
andras11
Staff
S
Staff
ShashankSecStaff
posted in Security Command Center
Sensitive Data Protection through SCC (Virtual Red Teaming)

Now customers that use Sensitive Data Protection discovery and publish the data profiles to Security Command Center, can configure Security Command Center to automatically set the priority value of certain high-value resources by the sensitivity of the data that the resources contain. To enable data-sensitivity prioritization, customers will need to specify the resources in a resource value configuration. Once enabled, if Sensitive Data Protection discovery classifies the data within a resource as either MEDIUM or HIGH sensitivity, the attack path simulations will, by default, assign a corresponding priority value (MEDIUM or HIGH) to that resource. What that means for our customer is that SCC’s Virtual Red Teaming will now take the type of data stored by the resource into consideration while running simulations for external attack possibilities resulting in higher Attack Exposure Scores for resources containing high sensitivity data . This saves customers the toil involved in classify

160
S
Staff
andras11
Staff
andras11Staff
posted in Security Command Center
Dynamic mute rules are now generally available

Security Command Center now supports dynamic mute rules, which allow you to mute future and existing findings temporarily until a specified date or indefinitely until a finding no longer matches the configuration. We are adding these rules as an alternative to the original static mute rules that only mute future findings indefinitely. We recommend using dynamic mute rules exclusively in your mute rule configurations because they are more flexible than static mute rules. Compared to static mute rules, dynamic mute rules have three key benefits: Dynamic mute rules apply to existing and new findings. Dynamic mute rules automatically mute both existing and new or updated findings that match your filter criteria. Dynamic mute rules offer an expiration option. Dynamic mute rules also allow you to set a custom expiration period to temporarily match specific findings. If no expiration period is set, dynamic mute rules mute findings indefinitely until they no longer match the rule. Dynamic mut

30
andras11
Staff
K
Krishna-YangaleBronze 1
posted in Security Command Center
How to Enable SCC Premium Programmatically?

Hi @All,I’m trying to enable Security Command Center (SCC) Premium programmatically for my Google Cloud project. However, I couldn’t find a clear way to do this in the documentation. If it’s possible to enable SCC Premium programmatically, could someone guide me on how to do it?Any code snippets, API references, or step-by-step instructions would be greatly appreciated.Thanks in advance for your help!

46
K
J
Julien_BouclierNew Member
posted in Security Command Center
Web Security Scanner fails to explore url

Hello, I'm trying to scan a web app and i am getting the error message "Errors occurred when browsing startup URLs during analysis. Check the login credentials and start URLs, and make sure the site is working correctly."My credentials are working on a browser, the app is also working properly. Is there a way to get detailed logs about the error ? I can only see "STARTING_URLS_CRAWL_HTTP_ERRORS" on the actual logs.Thank you for your help

31
vaskenh
Staff

Badge winners

  • Authored Posts 10
    mikelmi01has earned the badge Authored Posts 10
  • Solution 10
    bsalvatorehas earned the badge Solution 10
  • Comments Posted 1
    Kohei1117has earned the badge Comments Posted 1
  • Authored Posts 1
    hmdhas earned the badge Authored Posts 1
  • Comments Posted 1
    joaocarvalhohas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.