Google Security Command Center

Integration version: 12.0

Prerequisites

The minimal set of required permissions to integrate Security Command Center with Google Security Operations SOAR is as follows:

1. securitycenter.assets.list
2. securitycenter.findings.list
3. securitycenter.findings.setMute
4. securitycenter.findings.setState

Integrate Security Command Center with Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	N/A	Yes	API root of the Security Command Center instance.
Organization ID	String	N/A	No	ID of the organization that should be used in the Security Command Center integration.
User's Service Account	Password	N/A	Yes	Service account of the Security Command Center instance. A full content of the service account JSON file should be provided.
Verify SSL	Checkbox	Checked	Yes	If enabled, verifies that the SSL certificate for the connection to the Security Command Center server is valid.

Note: You can make changes at a later stage if needed. Once configured, the Instances can be used in Playbooks. For detailed information on configuring and supporting multiple instances, please see Supporting multiple instances.

Actions

Enrich Assets

Description

Enrich assets using information from Security Command Center.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Asset Resource Names	CSV	N/A	Yes	Specify a comma-separated list of resource names of the assets for which you want to return data.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
"siemplify_asset_display_name":[4] [5]  ""
"asset": {
        "name": "organizations/236378329325/assets/4140124989808983197",
        "securityCenterProperties": {
          "resourceName": "//compute.googleapis.com/projects/orbital-signal-243013/zones/europe-west1-b/instances/8494023830802519914",
          "resourceType": "google.compute.Instance",
          "resourceParent": "//cloudresourcemanager.googleapis.com/projects/469755381865",
          "resourceProject": "//cloudresourcemanager.googleapis.com/projects/469755381865",
          "resourceOwners": {
            "serviceAccount": [
              "[e-mail]",
              "[e-mail]"
            ],
            "user": [
              "[e-mail]",
              "[e-mail]",
              "[e-mail]"
            ]
          },
          "resourceDisplayName": "vm-wordpress",
          "resourceParentDisplayName": "orbital-signal-243013",
          "resourceProjectDisplayName": "orbital-signal-243013"
        },
        "resourceProperties": {
          "shieldedInstanceConfig": "{\"enableIntegrityMonitoring\":true,\"enableSecureBoot\":false,\"enableVtpm\":true}",
          "scheduling": "{\"automaticRestart\":true,\"onHostMaintenance\":\"MIGRATE\",\"preemptible\":false,\"provisioningModel\":\"STANDARD\"}",
          "labelFingerprint": "rs_6ubxpsZU=",
          "creationTimestamp": "2022-02-08T05:00:54.691-08:00",
          "networkInterfaces": "[{\"fingerprint\":\"DLL4fFQQkFU\\u003d\",\"name\":\"nic0\",\"network\":\"https://www.googleapis.com/compute/v1/projects/orbital-signal-243013/global/networks/scc-demo\",\"networkIP\":\"10.1.0.40\",\"stackType\":\"IPV4_ONLY\",\"subnetwork\":\"https://www.googleapis.com/compute/v1/projects/orbital-signal-243013/regions/europe-west1/subnetworks/vm-net1\"}]",
          "name": "vm-wordpress",
          "machineType": "https://www.googleapis.com/compute/v1/projects/orbital-signal-243013/zones/europe-west1-b/machineTypes/e2-standard-2",
          "serviceAccounts": "[{\"email\":\"[e-mail]\",\"scopes\":[\"https://www.googleapis.com/auth/devstorage.read_only\",\"https://www.googleapis.com/auth/logging.write\",\"https://www.googleapis.com/auth/monitoring.write\",\"https://www.googleapis.com/auth/pubsub\",\"https://www.googleapis.com/auth/service.management.readonly\",\"https://www.googleapis.com/auth/servicecontrol\",\"https://www.googleapis.com/auth/trace.append\"]}]",
          "tags": "{\"fingerprint\":\"AG-OvsszYew\\u003d\",\"items\":[\"wordpress\"]}",
          "fingerprint": "pJ1DSfT2-oM=",
          "labels": "{\"env\":\"scctest\"}",
          "canIpForward": false,
          "zone": "https://www.googleapis.com/compute/v1/projects/orbital-signal-243013/zones/europe-west1-b",
          "cpuPlatform": "Intel Broadwell",
          "disks": "[",
          "shieldedInstanceIntegrityPolicy": "{\"updateAutoLearnPolicy\":true}",
          "deletionProtection": false,
          "selfLink": "https://www.googleapis.com/compute/v1/projects/orbital-signal-243013/zones/europe-west1-b/instances/vm-wordpress",
          "startRestricted": false,
          "lastStartTimestamp": "2022-02-08T05:01:05.259-08:00",
          "status": "RUNNING",
          "id": "8494023830802519914"
        },
        "securityMarks": {
          "name": "organizations/236378329325/assets/4140124989808983197/securityMarks"
        },
        "createTime": "2022-02-08T13:00:55.518Z",
        "updateTime": "2022-04-27T20:12:50.687Z",
        "iamPolicy": {},
        "canonicalName": "projects/469755381865/assets/4140124989808983197"
      }
}

Entity Enrichment

Enrichment Table for google.compute.Instance - Prefix GSCC_

Enrichment Field Name	Source (JSON Key)	Logic - When to apply
resourceOwners_{key}	Csv of resourceOwners_{key}	When available in JSON
type	resourceType	When available in JSON
create_time	createTime	When available in JSON
update_time	updateTime	When available in JSON
related_service_accounts	csv of resourceProperties/serviceAccounts/email	When available in JSON
tags	csv resourceProperties/tags/items	When available in JSON
self_link	resourceProperties/selfLink	When available in JSON
status	resourceProperties/status	When available in JSON
ip_addresses	csv of resourcePropertie/networkInterfaces	When available in JSON

Enrichment Table for google.compute.Address - Prefix GSCC_

Enrichment Field Name	Source (JSON Key)	Logic - When to apply
resourceOwners_{key}	Csv of resourceOwners_{key}	When available in JSON
name	asset/resourceDisplayName	When available in JSON
type	resourceType	When available in JSON
create_time	createTime	When available in JSON
update_time	updateTime	When available in JSON
compute_create_time	resourceProperties/creationTimestamp	When available in JSON
compute_start_time	resourceProperties/lastStartTimestamp	When available in JSON
self_link	resourceProperties/selfLink	When available in JSON
start_restricted	resourceProperties/startRestricted	When available in JSON
purpose	resourceProperties/purpose	When available in JSON
description	resourceProperties/description	When available in JSON
address_type	resourceProperties/addressType	When available in JSON
network_tier	resourceProperties/networkTier	When available in JSON
status	resourceProperties/status	When available in JSON
address	resourceProperties/address	When available in JSON

Enrichment Table for google.iam.ServiceAccount - Prefix GSCC_

Enrichment Field Name	Source (JSON Key)	Logic - When to apply
resourceOwners_{key}	Csv of resourceOwners_{key}	When available in JSON
name	asset/resourceDisplayName	When available in JSON
type	resourceType	When available in JSON
create_time	createTime	When available in JSON
update_time	updateTime	When available in JSON
display_name	resourceProperties/displayName	When available in JSON
disabled	disabled	When available in JSON

Enrichment Table for google.cloud.storage.Bucket - Prefix GSCC_

Enrichment Field Name	Source (JSON Key)	Logic - When to apply
resourceOwners_{key}	Csv of resourceOwners_{key}	When available in JSON
type	resourceType	When available in JSON
create_time	createTime	When available in JSON
update_time	updateTime	When available in JSON
iam_roles	csv of iamPolicy/policyBlob/binding/role	When available in JSO

Insights

N/A

Case Wall

Result type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available for one asset (is_success=true): "Successfully enriched the following assets using information from Security Command Center: {asset.identifier}." If data is not available for one asset (is_success=true): "Action wasn't able to enrich the following assets using information from Security Command Center: {asset.identifier}." If data is not available for all assets (is_success=false): "None of the provided assets were enriched." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Assets". Reason: {0}''.format(error.Stacktrace)	General
Case Wall Table	Table Title: {entity.identifier} Table Columns: Key Value	Entity

Get Finding Details

Description

Get details about a finding in Security Command Center.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Finding Name	CSV	organizations/{organization_id}/sources/{source_id}/findings/{finding_id}	Yes	Specify a comma-separated list of finding names for which you want to return details. Note: Finding name has the following structure: organizations/{organization_id}/sources/{source_id}/findings/{finding_id}

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
      "finding_name": "organizations/236378329325/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m",
      "finding": {
        "name": "organizations/236378329325/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m",
        "parent": "organizations/236378329325/sources/2678067631293752869",
        "resourceName": "//cloudresourcemanager.googleapis.com/projects/469755381865",
        "state": "ACTIVE",
        "category": "Discovery: Service Account Self-Investigation",
        "sourceProperties": {
          "sourceId": {
            "projectNumber": "469755381865",
            "customerOrganizationNumber": "236378329325"
          },
          "detectionCategory": {
            "technique": "discovery",
            "indicator": "audit_log",
            "ruleName": "iam_anomalous_behavior",
            "subRuleName": "service_account_gets_own_iam_policy"
          },
          "detectionPriority": "LOW",
          "affectedResources": [
            {
              "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/469755381865"
            }
          ],
          "evidence": [
            {
              "sourceLogId": {
                "projectId": "orbital-signal-243013",
                "resourceContainer": "projects/orbital-signal-243013",
                "timestamp": {
                  "seconds": "1622678907",
                  "nanos": 448368000
                },
                "insertId": "v2rzg4d9u9q"
              }
            }
          ],
          "properties": {
            "serviceAccountGetsOwnIamPolicy": {
              "principalEmail": "[e-mail]",
              "projectId": "orbital-signal-243013",
              "callerIp": "52.39.60.41",
              "callerUserAgent": "Redlock/GC-MDC/resource-manager/orbital-signal-243013 Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)",
              "rawUserAgent": "Redlock/GC-MDC/resource-manager/orbital-signal-243013 Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)"
            }
          },
          "contextUris": {
            "mitreUri": {
              "displayName": "Permission Groups Discovery: Cloud Groups",
              "url": "https://attack.mitre.org/techniques/T1069/003/"
            },
            "cloudLoggingQueryUri": [
              {
                "displayName": "Cloud Logging Query Link",
                "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222021-06-03T00:08:27.448368Z%22%0AinsertId%3D%22v2rzg4d9u9q%22%0Aresource.labels.project_id%3D%22orbital-signal-243013%22?project=orbital-signal-243013"
              }
            ]
          }
        },
        "securityMarks": {
          "name": "organizations/236378329325/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m/securityMarks"
        },
        "eventTime": "2021-06-03T00:08:27.448Z",
        "createTime": "2021-06-03T00:08:31.074Z",
        "severity": "LOW",
        "canonicalName": "projects/469755381865/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m",
        "mute": "UNDEFINED",
        "findingClass": "THREAT",
        "mitreAttack": {
          "primaryTactic": "DISCOVERY",
          "primaryTechniques": [
            "PERMISSION_GROUPS_DISCOVERY",
            "CLOUD_GROUPS"
          ]
        }
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/projects/469755381865",
        "projectName": "//cloudresourcemanager.googleapis.com/projects/469755381865",
        "projectDisplayName": "orbital-signal-243013",
        "parentName": "//cloudresourcemanager.googleapis.com/organizations/236378329325",
        "parentDisplayName": "brinstar.net",
        "type": "google.cloud.resourcemanager.Project",
        "displayName": "orbital-signal-243013"
      }
    }
}

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available for findings (is_success=true): "Successfully returned details about the following findings in Security Command Center: {name of the findings that returned data}." If data is not available for one finding (is_success=true): "Action wasn't able to find the following findings in Security Command Center: {name of the findings that returned data}." If no data is available for findings (is_success=false): "None of the provided findings were found in Security Command Center." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Security Command Center". Reason: {0}''.format(error.Stacktrace) If an error is reported in the response: "Error executing action "Security Command Center". Reason: {0}''.format(error/message)	General
Case Wall Table	Table Name: Finding Details Table Columns: Category - category State - state Severity - severity Type - findingClass	General

List Asset Vulnerabilities

Description

List vulnerabilities related to the entities in Security Command Center.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Asset Resource Names	CSV	N/A	Yes	Specify a comma-separated list of resource names of the assets for which you want to return data.
Timeframe	DDL	All Time Possible Value: Last Week Last Month Last Year All Time	No	Specify the time frame for the vulnerabilities or misconfiguration search.
Record Types	DDL	Vulnerabilities + Misconfigurations Possible Values: Vulnerabilities Misconfigurations Vulnerabilities + Misconfigurations	No	Specify the type of record that should be returned.
Output Type	DDL	Statistics Possible Values: Statistics Data Statistics + Data	No	Specify the type of output that should be returned in the JSON result for the asset.
Max Records To Return	String	100	No	Specify the number of records to return per record type per assets.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
   ."siemplify_asset_display_name":[1] [2]  ""
"vulnerabilities": {
        "statistics": {
            "critical": 1,
            "high": 1,
            "medium": 1,
            "low": 1,
            "undefined": 1
        },
        "data": [
            {
                "category": {category}
                "description": {description}
                "cve_id": {vulnerability/cve/id}
                "event_time": {eventTime}
                "related_references": [{vulnerability/cve/references/uri}]
                "severity": {severity}
            }
        ]
    },
    "misconfigurations": {
        "statistics": {
            "critical": 1,
            "high": 1,
            "medium": 1,
            "low": 1,
            "undefined": 1
        },
        "data": [
            {
                "category": {category}
                "description": {description}
                "recommendation": {sourceProperties/Recommendation}
                "event_time": {eventTime}
                "severity": {severity}
            }
        ]
    },
}

Should either take from "resourceDisplayName" or "Asset Name" that was provided.
if securityCenterProperties.resourceType" == "google.iam.ServiceAccount", then action needs to use  "resourceProperties.email" as display_name.

if securityCenterProperties.resourceType" == "google.compute.Address", then action needs to use "resourceProperties.address" as display_name.

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available (is_success=true): "Successfully returned related vulnerabilities and misconfigurations to the following entities in Security Command Center: {assets}." If data is not available for one vulnerability or misconfiguration (is_success=true): "No vulnerabilities and misconfigurations were found to the following entities in Security Command Center: {assets}". If no data is available (is_success = true): "No vulnerabilities and misconfigurations were found for the provided assets in Security Command Center" The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Security Command Center". Reason: {0}''.format(error.Stacktrace) If an error is reported in the response: "Error executing action "Security Command Center". Reason: {0}''.format(error/message)	General
Case Wall Table	Table Name: {asset} Vulnerabilities Table Columns: Category - category Description - description Severity - severity Event Time - event_time CVE - cve_id	Per asset
Case Wall Table	Table Name: {asset} Misconfigurations Table Columns: Category - category Description - description Severity - severity Event Time - event_time Recommendation - cve_id	Per asset

Ping

Description

Test connectivity to Security Command Center with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If successful: "Successfully connected to the Security Command Center server with the provided connection parameters!" The action should fail and stop a playbook execution: If not successful: "Failed to connect to the Security Command Center server! Error is {0}".format(exception.stacktrace)"	General

Update Finding

Description

Update finding in Security Command Center.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Finding Name	CSV	organizations/{organization_id}/sources/{source_id}/findings/{finding_id}	Yes	Specify a comma-separated list of finding names which you want to update. Note: Finding name has the following structure: organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
Mute Status	DDL	Select One Possible Values: Select One Mute Unmute	No	Specify the mute status for the finding.
State Status	DDL	Select One Possible Values: Select One Active Inactive	No	Specify the state status for the finding.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available (is_success=true): "Successfully updated the following findings in Security Command Center: {name of the findings that returned data}." If data is not available for one finding (is_success=true): "Action wasn't able to find the following findings in Security Command Center: {name of the findings that returned data}." If no data is available (is_success=false): "None of the provided findings were found in Security Command Center" The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Update Finding". Reason: {0}''.format(error.Stacktrace) If an error is reported in the response: "Error executing action "Update Finding". Reason: {0}''.format(error/message) If the "Mute Status" or "State Status" parameter is set to "Select One": "Error executing action "Update Finding". Reason: at least one of "Mute Status" or "State Status" should have a value.''.format(error/message)	General

Connectors

Google Security Command Center - Findings Connector

Description

Pull information about findings from Security Command Center.

Note: The dynamic list filter works with categories.

Configure Google Security Command Center - Findings Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	Product Name	Yes	Enter the source field name in order to retrieve the Product Field name.
Event Field Name	String	type	Yes	Enter the source field name in order to retrieve the Event Field name.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regex pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field through regex logic. If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
API Root	String	N/A	Yes	API root of the Security Command Center instance.
Organization ID	String	N/A	No	ID of the organization that should be used in the Security Command Center integration.
User's Service Account	Password	N/A	Yes	Service account of the Security Command Center instance. A full content of the service account JSON file should be provided.
Finding Class Filter	CSV	Threat,Vulnerability,Misconfiguration,SCC_Error,Observation	No	Finding classes that should be ingested. Possible values: Threat, Vulnerability, Misconfiguration, SCC_Error, Observation. If nothing is provided, findings from all classes are ingested.
Lowest Severity To Fetch	String	High	No	The lowest severity that is used to fetch findings. Possible values: Low Medium High Critical Note: If finding with undefined severity is ingested, it has the Medium severity. If nothing is provided, findings with all severities are ingested.
Max Hours Backwards	Integer	1	No	Number of hours from where to fetch findings. Maximum: 24
Max Findings To Fetch	Integer	100	No	Number of findings to process per one connector iteration. Maximum: 1000
Use dynamic list as a blacklist	Checkbox	Unchecked	Yes	If enabled, the dynamic lists is used as a blocklist.
Verify SSL	Checkbox	Unchecked	Yes	If enabled, verifies that the SSL certificate for the connection to the Sumo Logic Cloud SIEM server is valid.
Proxy Server Address	String	N/A	No	The address of the proxy server to use.
Proxy Username	String	N/A	No	The proxy username to authenticate with.
Proxy Password	Password	N/A	No	The proxy password to authenticate with.

Connector Rules

Proxy Support

The connector supports proxy.