Activate the Security Command Center Enterprise tier

The Security Command Center Enterprise tier provides security enhancements such as advanced security operations, integrations with other Google Cloud products such as Sensitive Data Protection and Assured OSS, multi-cloud support, and risk analysis. For a description of the Enterprise tier features, see Security Command Center overview.

You complete the activation process for the Enterprise tier using the setup guide in the Google Cloud console. After the initial mandatory tasks, you can complete additional tasks to set up the optional features that your organization requires.

For information about pricing and getting a subscription, see Security Command Center pricing.

For instructions on activating Security Command Center at another tier, see Activate the Security Command Center Standard tier or Premium tier for an organization.

Before you begin

Complete these tasks before you complete the remaining tasks on this page.

Create an organization

Security Command Center requires an organization resource that is associated with a domain. If you haven't created an organization, see Creating and managing organizations.

Set up permissions

This section lists the Identity and Access Management roles that you need to set up Security Command Center and describes how to grant them.

Make sure that you have the following role or roles on the organization: Organization Admin, Cloud Asset Owner, Security Center Admin, Security Admin.
Check for the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the organization.
3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.
4. For all rows that specify or include you, check the Role colunn to see whether the list of roles includes the required roles.
Grant the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the organization.
3. Click Grant access.
4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.
5. In the Select a role list, select a role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Learn more about Security Command Center roles.

Verify organization policies

If your organization policies are set to restrict identities by domain, consider the following:

You must be signed in to the Google Cloud console on an account that's in an allowed domain.
Your service accounts must be in an allowed domain, or members of a group within your domain. This requirement lets you allow services that use the @*.gserviceaccount.com service account to access resources when domain restricted sharing is enabled.

If your organization policies are set to restrict resource usage, verify that the following APIs are permitted:

chronicle.googleapis.com
securitycenter.googleapis.com
securitycentermanagement.googleapis.com

Create the management project

Security Command Center Enterprise requires a project, which is called the management project, to enable its security operations and Mandiant integration.

If you enabled Google SecOps previously, you can use your existing management project. Otherwise, create a new one. Verify the roles and APIs on the project.

In the Google Cloud console, go to the project selector page.

Go to project selector
Select or create a Google Cloud project.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
Enable the Cloud Asset, Cloud Pub/Sub, Cloud Resource Manager, Compute Engine, Policy Analyzer, and Recommender APIs.
Enable the APIs

Make sure that you have the following role or roles on the project: Service Usage Admin, Service Account Token Creator, Chronicle API Admin, Chronicle Service Admin, Chronicle SOAR Admin, Service Account Key Admin, and Service Account Admin.
Check for the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the project.
3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.
4. For all rows that specify or include you, check the Role colunn to see whether the list of roles includes the required roles.
Grant the roles
1. In the Google Cloud console, go to the IAM page.
  Go to IAM
2. Select the project.
3. Click Grant access.
4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.
5. In the Select a role list, select a role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Connect to your existing Google Security Operations environment

During activation, you can connect to an existing Google Security Operations Standard, Enterprise, or Enterprise Plus environment by selecting the tenant from the list. After the connection, additional configuration is required. Contact your account team for guidance about configuring your Google Security Operations tenant to work with Security Command Center.

Configure notification contacts

Configure your Essential Contacts so that your security administrators can receive important notifications. For instructions, see Managing contacts for notifications.