gcloud alpha scc assets group

gcloud alpha scc assets group - filter an organization's assets and groups them by their specified properties
gcloud alpha scc assets group [ORGANIZATION] [--compare-duration=COMPARE_DURATION] [--filter=FILTER] [--group-by=GROUP_BY] [--page-size=PAGE_SIZE] [--page-token=PAGE_TOKEN] [--read-time=READ_TIME] [GCLOUD_WIDE_FLAG]
(ALPHA) Filter an organization's assets and groups them by their specified properties.
Organization resource - Refers to the source whose assets should be grouped by. This represents a Cloud resource.
ID of the organization or fully qualified identifier for the organization.
GroupAssetsResult's "state_change" attribute is updated to indicate whether the asset was added, removed, or remained present during the compare_duration period of time that precedes the read_time. Example duration: "100000s"
Expression is a list of one or more restrictions combined via logical operators 'AND' and 'OR'. Parentheses are not supported, and 'OR' has higher precedence than 'AND'. For example, 'update_time > 100 AND security_center_properties.resource_type=\"google.cloud.resourcemanager.Organization\"' is a valid filter string.
Expression that defines what asset fields to use for grouping (including 'state'). String value should follow SQL syntax: comma separated list of fields. For example: "parent,resource_name". The following fields are supported:
  • security_center_properties.resource_project
  • security_center_properties.resource_type
  • security_center_properties.resource_parent
  • state_change
The maximum number of results to return in a single response. Default is 10, minimum is 1, maximum is 1000.
Value returned by the last 'GroupAssetsResponse'; indicates that this is a continuation of a prior 'GroupAssets' call, and that the system should return the next page of data.
Time used as a reference point when filtering assets. Filter is limited to assets existing at the supplied time and their values are those at that specific time. For example: 2019-02-28T07:00:00Z. Absence of this field will default to the API's version of NOW.
These flags are available to all commands: --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

This command uses the securitycenter/v1 API. The full documentation for this API can be found at: https://console.cloud.google.com/apis/api/securitycenter.googleapis.com/overview
Group assets under organization 123456 by their type (e.g. project, disk, compute instance, service etc):
  $ gcloud alpha scc assets group 123456 \
      --group-by "security_center_properties.resource_type"

Group compute instances (assets) under organization 123456 by their respective projects:

  $ gcloud alpha scc assets group 123456 \
      --filter \
  nce\"" --group-by "security_center_properties.resource_project"

Group assets that were updated on or after 2019-01-01T01:00:00 GMT by their types.

  $ gcloud alpha scc assets group 123456 \
      --filter "update_time >= 1546304400000" \
      --group-by "security_center_properties.resource_type"

Group assets into following 3 state_changes (ADDED/DELETED/ACTIVE) based on the activity during past 24 hours:

  $ gcloud alpha scc assets group 123456 --compare-duration 86400s \
      --group-by "state_change"
This command is currently in ALPHA and may change without notice. If this command fails with API permission errors despite specifying the right project, you may be trying to access an API with an invitation-only early access whitelist.