Mute findings in Security Command Center

This page describes how to use Security Command Center's Mute Findings feature to control the volume of findings in your organization.

Overview

Mute Findings is a volume management feature in Security Command Center that lets you manually or programmatically hide irrelevant findings, and create filters to automatically silence existing and future findings based on criteria you specify.

Finding providers in Security Command Center supply broad security assessments of your Google Cloud deployment, but you might find that certain findings are not appropriate or relevant for your organization or projects. A high volume of findings also can make it difficult for your security analysts to effectively identify and remediate the most critical risks. Mute Findings saves you time from reviewing or responding to security findings for assets that are isolated or fall within acceptable business parameters.

Mute Findings versus allowlists

Mute Findings works differently than existing volume management solutions. Security Health Analytics lets you use dedicated security marks to add assets to allowlists, which stops detectors from creating security findings for specific assets. Security Command Center also lets you disable detectors.

However, Mute Findings offers several advantages over allowlists and disabling detectors:

  • You can mute findings without locating their underlying assets.
  • Findings that aren't attached to any resources can be muted.
  • You can create custom filters to fine-tune mute functionality.
  • Muting findings doesn't stop underlying assets from being scanned. Findings are still generated but remain hidden until you decide to view them.

The following video describes the benefits of Mute Findings and shows you how to use the feature in the Google Cloud Console.

Permissions

To use Mute Findings, you need one of the following Identity and Access Management (IAM) roles at the organization, folder, or project level:

  • View mute rules:
    • Security Center Admin Viewer (roles/securitycenter.adminViewer)
    • Security Center Settings Viewer (roles/securitycenter.settingsViewer)
    • Security Center Mute Configurations Viewer (roles/securitycenter.muteConfigsViewer)
  • View, create, update, and delete mute rules:
    • Security Center Admin (roles/securitycenter.admin)
    • Security Center Admin Editor (roles/securitycenter.adminEditor)
    • Security Center Settings Editor (roles/securitycenter.settingsEditor)
    • Security Center Mute Configurations Editor (roles/securitycenter.muteConfigsEditor)
  • Manually mute findings:
    • Security Center Findings Editor (roles/securitycenter.findingsEditor)

You can also create and grant custom roles with some or all of the following permissions:

  • Mute rule read permissions
    • securitycenter.muteconfigs.get
    • securitycenter.muteconfigs.list
  • Mute rule write permissions
    • securitycenter.muteconfigs.create
    • securitycenter.muteconfigs.update
    • securitycenter.muteconfigs.delete
  • Finding write permissions
    • securitycenter.findings.setMute
    • securitycenter.findings.bulkMuteUpdate

Mute Findings adheres to roles granted at the organization, folder, or project level. You can mute findings in specific folders or projects, and restrict the ability of others to mute findings based on the access they are granted. For example, if you have access to a single project, you can only mute findings in that project. If you have access to a folder, you can mute findings in any subfolder or project inside that folder.

To learn more about Security Command Center roles, see Access control.

Mute findings

You can manually mute individual findings, silence multiple findings at once with bulk mute filters, or create mute rules that automatically suppress future findings based on filters you define.

Findings contain a mute attribute that can be set to MUTED or UNMUTED. When you mute and unmute findings, you change the value of the attribute. For more information, see Mute finding properties.

Mute Findings is relevant for many use cases, including the following:

  • Assets within non-production environments where some stricter requirements might not be applicable.
  • Recommendations to use customer-managed encryption keys in projects that don't contain critical data.
  • When granting broad access on a datastore, which intentionally is open to the public and disseminates public information.
  • Findings that aren't relevant to your organization based on your company's policies.

Muted findings continue to be logged for audit and compliance purposes, and can be viewed if needed. However, they don't appear by default in the Security Command Center dashboard. You also can filter muted findings from Pub/Sub notifications and Security Command Center API calls using the finding's mute attribute.

Mute individual findings

To mute individual findings, perform the following steps:

Console

  1. In the Cloud Console, go to the Security Command Center Findings page.

    Go to Findings

  2. If necessary, select your Google Cloud project or organization. Project selector

  3. Click More Options, and then be sure Include muted findings is not checked.

  4. If you're only interested in reviewing specific types of findings, you can quickly filter the table:

    1. Next to View by, there are options to filter findings by Category, Source type, Severity, state and mute status.
    2. Alternatively, in the Filter box, enter attributes and values to filter findings.
  5. Select the checkboxes next to the findings you want to mute.

  6. Click Mute Options, and then select Mute.

    Muted findings are removed from the table and the mute attribute for the selected findings is set to MUTED.

  7. Alternatively, on the Findings page, click the name of an individual finding in the table to open its Finding Details pane.

  8. Click Mute, and then select one of the following options:

    • Mute: the single finding is muted.
    • Mute findings like this: opens a page to create a mute rule for findings of the same type or that include the same Indicator attribute.

      For more information on mute rules, see Create mute rules.

gcloud

To set a finding's mute state to MUTED, use the set-mute command in the gcloud tool:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc findings set-mute FINDING_ID \
        --RESOURCE=RESOURCE_ID \
        --source=SOURCE_ID \
        --mute=MUTED
    

    Replace the following:

    • FINDING_ID: the ID for the finding you want to mute

      To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

    • RESOURCE: the parent resource (project, folder, or organization), case-sensitive

    • RESOURCE_ID: the resource ID (project ID, folder ID, or organization ID)

    • SOURCE_ID: the source ID

      For instructions on retrieving a source ID, see Getting the source ID.

API

In the API, use the setMute method to execute the following request. The request body is an enum that indicates the desired mute state.

POST https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/sources/SOURCE_ID/findings/FINDING_ID:setMute

{
  "mute": "MUTED"
}

Replace the following:

  • RESOURCE: the parent resource (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • SOURCE_ID: the numeric ID for the source

    For instructions on retrieving a source ID, see Getting the source ID.

  • FINDING_ID: the ID for the finding you want to mute

    To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

Selected findings are hidden, and the mute attribute for the findings is set to MUTED.

Muting findings doesn't change a finding's state. If an active finding is muted, it is hidden but remains active until the underlying vulnerability, misconfiguration, or threat is resolved.

Unmute individual findings

To unmute findings, perform the following steps:

Console

  1. In the Google Cloud Console, go to the Security Command Center Findings page.

    Go to Findings

  2. If necessary, select your Google Cloud project or organization. Project selector

  3. On the Findings page, next to View by, select More options.

  4. Select Include muted findings.

    The findings table is updated to include muted findings.

  5. Select the checkboxes next to the findings you want to unmute.

  6. Click Mute Options, and then select Unmute.

    The selected findings are unmuted and their mute attribute is set to UNMUTED.

  7. Alternatively, on the Findings page, click the name of a muted finding in the table to open its Finding Details pane.

  8. Click Unmute.

gcloud

To set a finding's mute state to UNMUTED, use the set-mute command in the gcloud tool:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc findings set-mute FINDING_ID \
        --RESOURCE=RESOURCE_ID \
        --source=SOURCE_ID \
        --mute=UNMUTED
    

    Replace the following:

    • FINDING_ID: the ID for the finding you want to mute

      To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

    • RESOURCE: the parent resource (project, folder, or organization ), case-sensitive

    • RESOURCE_ID: the resource ID (project ID, folder ID, or organization ID)

    • SOURCE_ID: the source ID

      For instructions on retrieving a source ID, see Getting the source ID

API

In the API, use the setMute method to execute the following request. The request body is an enum that indicates the desired mute state.

POST https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/sources/SOURCE_ID/findings/FINDING_ID:setMute

{
  "mute": "UNMUTED"
}

Replace the following:

  • RESOURCE: the parent resource (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • SOURCE_ID: the numeric ID for the source

    For instructions on retrieving a source ID, see Getting the source ID)

  • FINDING_ID: the ID for the finding you want to mute.

    To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

Selected findings are no longer hidden, and the mute attribute for the findings is set to UNMUTED.

Unmuted findings override mute rules

If a user unmutes findings, they remain unmuted even if existing mute rules still match the findings. In effect, unmute actions by users override mute rules.

Unmuted findings are muted again only if a user manually mutes the findings or creates a new matching mute rule in the Cloud Console. Mute rules created with the gcloud tool or Security Command Center API won't affect findings unmuted by users.

Bulk mute findings

You can use the Security Command Center API to bulk mute existing findings based on filters you specify. If you also want to mute similar future findings, use the same filters to create mute rules.

Bulk mute filters don't support all finding properties. For a list of available properties, see Supported finding properties for mute rules.

To bulk mute findings, perform the following steps:

Console

In the Cloud Console, you can only bulk mute findings by creating mute rules. In the Cloud Console, creating mute rules silences existing and future findings.

gcloud

To bulk mute findings, run the gcloud scc findings bulk-mute command:

  1. Open a terminal window.
  2. Run the following command:

    gcloud scc findings bulk-mute \
        --RESOURCE=RESOURCE_ID \
        --filter="FILTER"
    

    Replace the following:

    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource
    • FILTER: the expression you define to filter findings

    For example, to mute all existing low-severity OPEN_FIREWALL and PUBLIC_IP_ADDRESS findings in the internal-test project, your filter can be "category=\"OPEN_FIREWALL\" OR category=\"PUBLIC_IP_ADDRESS\" AND severity=\"LOW\" AND resource.project_display_name=\"internal-test\"".

API

In the API, use the bulkMute method to execute the following request. The request body contains the expression used to filter findings.

POST https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/findings:bulkMute -d

  {
    "filter": "FILTER"
  }

Replace the following:

  • RESOURCE: the parent resource (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • FILTER: the expression you define to filter findings

    For example, to mute all existing low-severity OPEN_FIREWALL and PUBLIC_IP_ADDRESS findings in the internal-test project, your filter can be "category=\"OPEN_FIREWALL\" OR category=\"PUBLIC_IP_ADDRESS\" AND severity=\"LOW\" AND resource.project_display_name=\"internal-test\"".

All existing findings in the resource you select, and which exactly match the filter, are hidden. The mute attribute for the findings is set to MUTED.

Muting findings doesn't change their state. If active findings are muted, they are hidden but remain active until the underlying vulnerabilities, misconfigurations, or threats are resolved.

Create mute rules

Mute rules are Security Command Center configurations that use filters you create to automatically mute future findings based on criteria you specify. New findings that match mute filters are automatically muted on an ongoing basis. If you also want to mute similar existing findings, use the same filters to bulk mute findings.

For more information on creating filters, see Filtering notifications.

Mute rules don't support all finding properties. For a list of properties that can be used, see Supported finding properties for mute rules.

Your organization can create a maximum of 1,000 mute rules. To create a mute rule, perform the following steps:

Console

  1. In the Google Cloud Console, go to the Security Command Center Findings page.

    Go to Findings

  2. If necessary, select your Google Cloud project or organization. Project selector

  3. Click Mute Options, and then select Create mute rule.

  4. Enter a Mute rule ID. This value is required.

  5. Enter a Mute rule description that provides context for why findings are muted. This value is optional but recommended.

  6. Parent resource indicates the scope at which the mute rule will be created and applied.

  7. In the Findings query field, enter finding properties and filter values using standard SQL operators AND,OR, equals (=), contains (:), and not (-). You can create queries in two ways:

    1. Type your query in the box, using supported finding properties and filter values.

      For example, the following query mutes low- and medium-severity anomalous IAM grant findings in prod-project, and excludes resource types where the name contains the substring "compute":

      severity="LOW" OR severity="MEDIUM" AND category="Persistence: IAM Anomalous Grant" AND resource.project_display_name="prod-project" AND -resource.type:"compute".

      For more examples on filtering findings, see Filtering notifications.

    2. Alternatively, click Add Filter.

      The Select filter dialog lets you choose supported finding properties and values.

      Query filter dialog

      1. Click the name of a finding property or type its name in the Search finding properties box.
      2. Click a filter value in the list or type its name in the Search filter values box.
      3. For the selected value, in the drop-down menu, choose one of the following operators:
        • Equals: findings with this exact filter value are muted
        • Does not equal: findings that don't have this exact filter value are muted
        • Has: findings with filter values that contain the text you enter in the Keyword field are muted
        • Does not have: findings with filter values that don't contain the text you enter in the Keyword field are muted
      4. Click Apply.

        The dialog closes and your query is updated.

      5. Repeat until the findings query contains all of the properties you want.

  8. Review the filter for accuracy. To make changes, delete or add properties and filter values as needed.

  9. Click Preview Matching Findings.

    A table displays findings that match your query.

  10. Click Save.

gcloud

To create mute rules, do the following:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc muteconfigs create RULE_NAME \
        --RESOURCE=RESOURCE_ID \
        --description=RULE_DESCRIPTION \
        --filter=FILTER
    

    Replace the following:

    • RULE_NAME: the name of the mute rule (between 1 and 63 characters)
    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource
    • RULE_DESCRIPTION: a description of the mute rule (max: 1,024 characters)
    • FILTER: the expression you define to filter findings

      For example, to mute OPEN_FIREWALL findings, your filter can be FILTER="category=\"OPEN_FIREWALL\"").

    The response includes the mute config ID, which you can use to view, update, and delete mute rules, as described in Manage mute rules.

API

In the API, use the muteConfigs create method to execute the following request. The request body is an instance of MuteConfig.

POST https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/muteConfigs?muteConfigId=MUTE_RULE_ID -d

  {
    "description": "RULE_DESCRIPTION",
    "filter": FILTER
  }

Replace the following:

  • RESOURCE: the parent resource for your mute rule (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • MUTE_RULE_ID: the name of the mute rule (between 1 and 63 characters)
  • RULE_DESCRIPTION: a description of the mute rule (max: 1,024 characters)
  • FILTER: the expression you define to filter findings

    For example, to mute OPEN_FIREWALL findings, your filter can be "category=\"OPEN_FIREWALL\"".

The response includes the mute config ID, which you can use to view, update, and delete mute rules, as described in Manage mute rules.

New findings that exactly match the filter are hidden, and the mute attribute for the findings is set to MUTED.

Supported finding properties for mute rules

Mute Findings doesn't support all finding properties in filters. The following properties can be used in mute rule filters.

  • resource.name
  • resource.project_name
  • resource.project_display_name
  • resource.parent_name
  • resource.parent_display_name
  • resource.type
  • resource.folders.resource_folder
  • category
  • severity
  • finding_class
  • indicator.domains
  • indicator.ip_addresses

Mute finding properties

This section lists mute finding properties, and describes how they are impacted by mute operations:

  • mute: set to UNDEFINED when findings are created and changes in the following scenarios:
    • MUTED: a finding is muted manually or by a mute rule.
    • UNMUTED: a user unmutes a finding.
  • mute_update_time: the time that a finding gets muted or unmuted
  • mute_initiator: the identifier for the principal or mute rule that muted a finding

Stop notifications for muted findings

If you enable finding notifications, muted findings that match your notification filters still trigger notifications in Pub/Sub.

To stop notifications for muted findings, use the mute attribute to exclude muted findings in your NotificationConfig filter. For example, the following filter only sends notifications for active findings that are not muted or where the mute attribute hasn't been set:

FILTER="state=\"ACTIVE\" AND -mute=\"MUTED\""

Manage mute rules

You can view, update, and delete mute rules based on the scope of your IAM roles. With organization-level roles, you see mute rules for all folders and projects within the organization. If you have folder-level roles, you can access and manage mute rules for specific folders and all subfolders and projects within those folders. Project-level roles let you manage mute rules in specific projects.

Security Command Center Premium supports granting roles at the organization, folder, and project levels. Security Command Center Standard only supports granting roles at the organization level. For more information, see Access control.

List mute rules

To see a list of mute rules, for your organizations, folders, or projects—depending on the scope of your IAM roles—perform the following steps:

Console

  1. In the Google Cloud Console, go to the Mute Rules tab in the Security Command Center Settings page.

    Go to Mute Rules

  2. If necessary, select your Google Cloud project or organization. Project selector
  3. In the Mute rules section, you see details for active mute rules, including the following:
    • Name: mute rule ID
    • Parent resource: the resource where the mute rule lives
    • Description: the mute rule description, if available
    • Last updated by: the principal who last updated the rule
    • Last updated: the date and time the rule was last updated

gcloud

To list mute rules, do the following:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc muteconfigs list --RESOURCE=RESOURCE_ID
    

    Replace the following:

    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource

API

In the API, use the muteConfigs list method to make the following request. The request body is empty.

GET https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/muteConfigs

Replace the following:

  • RESOURCE: the parent resource for your mute rule (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource

The response includes the names, descriptions, and mute config IDs for your mute rules.

View mute rules

To view a mute rule, perform the following steps:

Console

  1. In the Google Cloud Console, go to the Mute Rules tab in the Security Command Center Settings page.

    Go to Mute Rules

  2. If necessary, select your Google Cloud project or organization. Project selector
  3. In the Mute rules section, you see a list of mute rules.
  4. Click the name of the rule you want to view.

    A page opens with the mute rule's configuration.

gcloud

To view mute rules, do the following:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc muteconfigs get MUTE_CONFIG_ID \
        --RESOURCE=RESOURCE_ID
    

    Replace the following:

    • MUTE_CONFIG_ID: the ID for the mute config
    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource

API

In the API, use the muteConfigs get method to make the following request. The request body is empty.

To get the CONFIG_ID for mute rules, first execute an API call to List mute rules. The response includes config IDs for returned mute rules.

GET https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/muteConfigs/CONFIG_ID

Replace the following:

  • RESOURCE: the parent resource for your mute rule (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • CONFIG_ID: the numeric ID of the mute rule

Update mute rules

You can update mute rules by changing their descriptions and filters. However, you can't change mute rule IDs or parent resources. To change a mute rule ID, you must create a new mute rule.

To update a mute rule, perform the following steps:

Console

  1. In the Google Cloud Console, go to the Mute Rules tab in the Security Command Center Settings page.

    Go to Mute Rules

  2. Select the Google Cloud project or organization that is the parent resource for the mute rule you want to modify. Project selector

  3. Click the name of the mute rule you want to modify.

    If you didn't select the appropriate project or organization, you might see a note informing you that you don't have permission to modify the mute rule.

  4. Enter a new description, and then click Save.

  5. Update or change the filter.

    For instructions, see Create mute rules.

  6. To view findings that match the updated filter, click Preview Matching Findings.

    A table loads with findings that match the new query.

  7. Click Save.

gcloud

To update mute rules, do the following:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc muteconfigs update MUTE_CONFIG_ID \
        --RESOURCE=RESOURCE_ID \
        --description=RULE_DESCRIPTION \
        --filter=FILTER
    

    Replace the following:

    • MUTE_CONFIG_ID: the ID for the mute config
    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource
    • RULE_DESCRIPTION: a description of the mute rule (max: 1,024 characters)
    • FILTER: the expression you define to filter findings

      For example, to mute OPEN_FIREWALL findings, your filter could be FILTER="category=\"OPEN_FIREWALL\"").

API

In the API, use the muteConfigs patch method to make the following request. The request body is an instance of MuteConfig.

To get the CONFIG_ID for mute rules, first execute an API call to list mute rules. The response includes config IDs for returned mute rules.

PATCH https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/muteConfigs/CONFIG_ID

  {
    "description": "RULE_DESCRIPTION",
    "filter": "FILTER",
  }

Replace the following:

  • RESOURCE: the parent resource for your mute rule (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • CONFIG_ID: the numeric ID of the mute rule
  • RULE_DESCRIPTION: a description of the mute rule (max: 1,024 characters)
  • FILTER: the expression you define to filter findings

    For example, to mute OPEN_FIREWALL findings, your filter can be "category=\"OPEN_FIREWALL\"").

New findings that exactly match the filter are hidden, and the mute attribute for the findings is set to MUTED.

Updating mute rules doesn't automatically unmute any findings that were muted by previous rules. You must manually unmute findings.

Delete mute rules

Before deleting mute rules, understand the following:

  • You can't recover deleted mute rules.
  • Deleting mute rules doesn't automatically unmute any findings that are currently muted. You must manually or programmatically unmute findings.
  • Future findings that match filters in deleted mute rules aren't muted.

To delete a mute rule, perform the following steps:

Console

  1. In the Google Cloud Console, go to the Mute Rules tab in the Security Command Center Settings page.

    Go to Mute Rules

  2. If necessary, select your Google Cloud project or organization. Project selector

  3. Click the name of the mute rule you want to delete.

  4. Click Delete.

  5. Read the dialog and, if satisfied, click Delete.

gcloud

To delete mute rules, do the following:

  1. Open a terminal window.
  2. Run the following command:

      gcloud scc muteconfigs delete MUTE_CONFIG_ID \
        --RESOURCE=RESOURCE_ID
    

    Replace the following:

    • MUTE_CONFIG_ID: the ID for the mute config
    • RESOURCE: the parent resource for your mute rule (organization, folder, or project)
    • RESOURCE_ID: the numeric ID for the selected resource
  3. Confirm your request to delete the mute rule.

API

In the API, use the muteConfigs delete method to make the following request. The request body is empty.

To get the CONFIG_ID for mute rules, execute an API call to list mute rules. The response includes config IDs for returned mute rules.

DELETE https://securitycenter.googleapis.com/v1/RESOURCE/RESOURCE_ID/muteConfigs/CONFIG_ID

Replace the following:

  • RESOURCE: the parent resource for your mute rule (organizations, folders, or projects)
  • RESOURCE_ID: the numeric ID for the selected resource
  • CONFIG_ID: the numeric ID of the mute rule

What's next

Learn more about filtering finding notifications.