Security sources for vulnerabilities and threats

This page contains a list of the Google Cloud security sources that are available in Security Command Center. When you enable a security source, it provides vulnerabilities and threat data in the Security Command Center dashboard.

Security Command Center lets you filter and view vulnerabilities and threat findings in many different ways, like filtering on a specific finding type, resource type, or for a specific asset. Each security source might provide more filters to help you organize your organization's findings.

Security Command Center roles are granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, security sources, and security marks depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.


Vulnerability detectors can help you find potential weaknesses in your Google Cloud resources.

Security Health Analytics vulnerability types

Security Health Analytics managed vulnerability assessment scanning for Google Cloud can automatically detect common vulnerabilities and misconfigurations across:

  • Cloud Monitoring and Cloud Logging
  • Compute Engine
  • Google Kubernetes Engine containers and networks
  • Cloud Storage
  • Cloud SQL
  • Identity and Access Management (IAM)
  • Cloud Key Management Service (Cloud KMS)
  • Cloud DNS

Security Health Analytics is automatically enabled when you select the Security Command Center Standard or Premium tier. Security Health Analytics detectors monitor a subset of resources from Cloud Asset Inventory (CAI), using the following three scan modes to detect vulnerabilities:

  • Batch scan: All detectors are scheduled to run for all enrolled organizations two or more times a day. Detectors run on different schedules to meet specific service level objectives (SLO). To meet 12- and 24-hour SLOs, detectors run batch scans every six hours or 12 hours, respectively. Resource and policy changes that occur in between batch scans are not immediately captured and are applied in the next batch scan. Note: Batch scan schedules are performance objectives, not service guarantees.

  • Real-time scan: Supported detectors start scans whenever CAI reports a change in an asset's configuration. Findings are immediately written to Security Command Center.

  • Mixed-mode: Some detectors that support real-time scans may not detect changes in real time in all supported assets. In those cases, configuration changes for some assets are captured immediately and others are captured in batch scans.

To view a complete list of Security Health Analytics detectors and findings, see the Security Health Analytics findings page, or expand the following section.

Web Security Scanner

Web Security Scanner provides managed and custom web vulnerability scanning for public App Engine, GKE, and Compute Engine serviced web applications.

Managed scans

Web Security Scanner managed scans are configured and managed by Security Command Center. Managed scans automatically run once each week to detect and scan public web endpoints. These scans don't use authentication and they send GET-only requests so they don't submit any forms on live websites.

Managed scans run separately from custom scans that you define at the project level. You can use managed scans to centrally manage basic web application vulnerability detection for projects in your organization, without having to involve individual project teams. When findings are discovered, you can work with those teams to set up more comprehensive custom scans.

When you enable Web Security Scanner as a service, managed scan findings are automatically available in the Security Command Center vulnerabilities tab and related reports. For information about how to enable Web Security Scanner managed scans, see configuring Security Command Center.

Custom scans

Web Security Scanner custom scans provide granular information about application vulnerability findings, like outdated libraries, cross-site scripting, or use of mixed content. Custom scan findings are available in Security Command Center after you complete the guide to set up Web Security Scanner custom scans.

Detectors and compliance

Web Security Scanner supports a subset of categories in OWASP Top Ten, a document that ranks and provides remediation guidance for the top 10 most critical web application security risks, as determined by the Open Web Application Security Project (OWASP).

The compliance mapping is included for reference and is not provided or reviewed by the OWASP Foundation.

This functionality is only intended for you to monitor for compliance controls violations. The mappings are not provided for use as the basis of, or as a substitute for, the audit, certification, or report of compliance of your products or services with any regulatory or industry benchmarks or standards.

Web Security Scanner custom and managed scans identify the following finding types. In the Standard tier, Web Security Scanner supports custom scans of deployed applications with public URLs and IPs that aren't behind a firewall.

Table 19. Web Security Scanner findings
Category Finding description CIS GCP Foundation 1.0 PCI-DSS v3.2.1 OWASP Top 10 NIST 800-53 ISO-27001
ACCESSIBLE_GIT_REPOSITORY A Git repository is exposed publicly. To resolve this finding, remove unintentional public access to the GIT repository. A3
ACCESSIBLE_SVN_REPOSITORY An SVN repository is exposed publicly. To resolve this finding, remove public unintentional access to the SVN repository. A3
CLEAR_TEXT_PASSWORD Passwords are being transmitted in clear text and can be intercepted. To resolve this finding, encrypt the password transmitted over the network. A3
INVALID_CONTENT_TYPE A resource was loaded that doesn't match the response's Content-Type HTTP header. To resolve this finding, set `X-Content-Type-Options` HTTP header with the correct value. A6
INVALID_HEADER A security header has a syntax error and is ignored by browsers. To resolve this finding, set HTTP security headers correctly. A6
MISMATCHING_SECURITY_HEADER_VALUES A security header has duplicated, mismatching values, which result in undefined behavior. To resolve this finding, set HTTP security headers correctly. A6
MISSPELLED_SECURITY_HEADER_NAME A security header is misspelled and is ignored. To resolve this finding, set HTTP security headers correctly. A6
MIXED_CONTENT Resources are being served over HTTP on an HTTPS page. To resolve this finding, make sure that all resources are served over HTTPS. A6
OUTDATED_LIBRARY A library was detected that has known vulnerabilities. To resolve this finding, upgrade libraries to a newer version. A9
XSS A field in this web application is vulnerable to a cross-site scripting (XSS) attack. To resolve this finding, validate and escape untrusted user-supplied data. A7
XSS_ANGULAR_CALLBACK A user-provided string isn't escaped and AngularJS can interpolate it. To resolve this finding, validate and escape untrusted user-supplied data handled by Angular framework. A7
XSS_ERROR A field in this web application is vulnerable to a cross-site scripting attack. To resolve this finding, validate and escape untrusted user-supplied data. A7


Threat detectors can help you find potentially harmful events.

Anomaly Detection

Anomaly Detection is a built-in service that uses behavior signals from outside your system. It displays granular information about security anomalies detected for your projects and Virtual Machine (VM) instances, like potential leaked credentials and coin mining. Anomaly Detection is automatically enabled when you subscribe to Security Command Center Standard or Premium tier, and findings are available in the Security Command Center dashboard.

Example Anomaly Detection findings include the following:

Table B. Anomaly Detection finding categories
Potential for Compromise Description
account_has_leaked_credentials Credentials for a Google Cloud service account are accidentally leaked online or are compromised.
resource_compromised_alert Potential compromise of a resource in your organization.
Abuse Scenarios Description
resource_involved_in_coin_mining Behavioral signals around a VM in your organization indicate that a resource might have been compromised and could be getting used for cryptomining.
outgoing_intrusion_attempt Intrusion attempts and Port scans: One of the resources or Google Cloud services in your organization is being used for intrusion activities, like an attempt to break in or compromise a target system. These include SSH brute force attacks, Port scans, and FTP brute force attacks.
resource_used_for_phishing One of the resources or Google Cloud services in your organization is being used for phishing.

Container Threat Detection

Container Threat Detection can detect the most common container runtime attacks and alert you in Security Command Center and optionally in Cloud Logging. Container Threat Detection includes several detection capabilities, an analysis tool, and an API.

Container Threat Detection detection instrumentation collects low-level behavior in the guest kernel to detect the following events:

  • Added Binary Executed
  • Added Library Loaded
  • Reverse Shell

Learn more about Container Threat Detection.

Cloud Data Loss Prevention

Cloud DLP Data Discovery enables you to surface the results of Cloud Data Loss Prevention (Cloud DLP) scans directly in the Security Command Center dashboard and findings inventory. Cloud DLP can help you to better understand and manage sensitive data and Personally Identifiable Information (PII) like the following:

  • Credit card numbers
  • Names
  • Social security numbers
  • US and selected international identifying numbers
  • Phone numbers
  • Google Cloud credentials

Each Cloud DLP Data Discovery finding only includes the category type of the identified PII data and the resource it was found in. It doesn't include any of the specific underlying data.

After you complete the setup steps described in the guide to send DLP API results to Security Command Center, Cloud DLP scan results display in Security Command Center.

For more information:

Event Threat Detection

Event Threat Detection uses log data from inside your systems. It watches your organization's Cloud Logging stream for one or more projects, and consumes logs as they become available. When a threat is detected, Event Threat Detection writes a finding to Security Command Center and to a Cloud Logging project. Event Threat Detection is automatically enabled when you subscribe to the Security Command Center Premium tier and findings are available in the Security Command Center dashboard.

Example Event Threat Detection findings include the following:

Table C. Event Threat Detection finding types
Data exfiltration

Event Threat Detection detects data exfiltration from BigQuery by examining audit logs for two scenarios:

  • A resource is saved outside of your organization, or a copy operation is attempted that is blocked by VPC Service Controls.
  • An attempt is made to access BigQuery resources that are protected by VPC Service Controls.
Brute force SSH Event Threat Detection detects brute force of password authentication SSH by examining syslog logs for repeated failures followed by a success.
Cryptomining Event Threat Detection detects coin mining malware by examining VPC flow logs and Cloud DNS logs for connections to known bad domains for mining pools.
IAM abuse

Anomalous IAM grants: Event Threat Detection detects the addition of IAM grants that might be considered anomalous, like:

  • Adding a user to a policy with the project editor role.
  • Inviting a user as a project owner from the Google Cloud Console.
  • Service account granting sensitive permissions.
  • Custom role granted sensitive permissions.
  • Service account added from outside your organization.
Malware Event Threat Detection detects malware by examining VPC flow logs and Cloud DNS logs for connections to known command and control domains and IPs.
Phishing Event Threat Detection detects phishing by examining VPC flow logs and Cloud DNS logs for connections to known phishing domains and IPs.
Outgoing DoS Event Threat Detection examines VPC flow logs to detect outgoing denial of service traffic.
Anomalous IAM Behavior
Event Threat Detection detects anomalous IAM behavior by examining Cloud Audit Logs for accesses from anomalous IP addresses and anomalous user agents.
Service account self-investigation Event Threat Detection detects when a service account credential is used to investigate the roles and permissions associated with that same service account.

Learn more about Event Threat Detection.

Forseti Security

Forseti Security gives you tools to understand all the resources you have in Google Cloud. The core Forseti modules work together to provide complete information so you can secure resources and minimize security risks.

To display Forseti violation notifications in Security Command Center, follow the Forseti Security Command Center notification guide.

For more information:

Phishing Protection

Phishing Protection helps prevent users from accessing phishing sites by classifying malicious content that uses your brand and reporting the unsafe URLs to Google Safe Browsing. After a site is propagated to Safe Browsing, users see warnings across more than three billion devices.

To get started with Phishing Protection, follow the guide to Enable Phishing Protection. After you enable Phishing Protection, results are displayed in Security Command Center in the Phishing Protection card under Findings.

What's next