Activate the Security Command Center Enterprise tier

The Security Command Center Enterprise tier provides security enhancements such as advanced security operations, integrations with other Google Cloud products such as Sensitive Data Protection and Assured OSS, multi-cloud support, and risk analysis. For a description of the Enterprise tier features, see Security Command Center overview.

You complete the activation process for the Enterprise tier using the setup guide in the Google Cloud console. After the initial mandatory tasks, you can complete additional tasks to set up the optional features that your organization requires.

For information about pricing and getting a subscription, see Security Command Center pricing.

For instructions on activating Security Command Center at another tier, see Activate the Security Command Center Standard tier or Premium tier for an organization.

Before you begin

Complete these tasks before you complete the remaining tasks on this page.

Create an organization

Security Command Center requires an organization resource that is associated with a domain. If you haven't created an organization, see Creating and managing organizations.

Set up permissions

This section lists the Identity and Access Management roles that you need to set up Security Command Center and describes how to grant them.

Make sure that you have the following role or roles on the organization: Organization Admin, Cloud Asset Owner, Security Center Admin, Security Admin, Create Service Accounts, and Chronicle Service Admin.
Check for the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the organization.
3. In the Principal column, find the row that has your email address.
  
  If your email address isn't in that column, then you do not have any roles.
4. In the Role column for the row with your email address, check whether the list of roles includes the required roles.
Grant the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the organization.
3. Click Grant access.
4. In the New principals field, enter your email address.
5. In the Select a role list, select a role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Learn more about Security Command Center roles.

Verify organization policies

If your organization policies are set to restrict identities by domain, consider the following:

You must be signed in to the Google Cloud console on an account that's in an allowed domain.
Your service accounts must be in an allowed domain, or members of a group within your domain. This requirement lets you allow services that use the @*.gserviceaccount.com service account to access resources when domain restricted sharing is enabled.

If your organization policies are set to restrict resource usage, verify that securitycenter.googleapis.com is permitted.

Create the management project

Security Command Center Enterprise requires a project, which is called the management project, to enable its security operations and Mandiant integration.

If you enabled Google SecOps previously, you can use your existing management project. Otherwise, create a new one. Verify the roles and APIs on the project.

In the Google Cloud console, go to the project selector page.

Go to project selector
Select or create a Google Cloud project.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
Enable the Cloud Asset, Cloud Pub/Sub, Cloud Resource Manager, Compute Engine, Policy Analyzer, and Recommender APIs.
Enable the APIs

Make sure that you have the following role or roles on the project: Service Usage Admin, Create Service Accounts, Service Account Token Creator, Chronicle Service Admin, Chronicle SOAR Admin, Service Account Key Admin, and Service Account Admin.
Check for the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the project.
3. In the Principal column, find the row that has your email address.
  
  If your email address isn't in that column, then you do not have any roles.
4. In the Role column for the row with your email address, check whether the list of roles includes the required roles.
Grant the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the project.
3. Click Grant access.
4. In the New principals field, enter your email address.
5. In the Select a role list, select a role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Obtain your Google Security Operations access code

If you already have an instance of Google SecOps, you can use an access code during activation to connect the Security Command Center Enterprise tier to it. Contact Google Cloud sales to obtain your access code.

Configure notification contacts

Configure your Essential Contacts so that your security administrators can receive important notifications. For instructions, see Managing contacts for notifications.