或者，您可以在资源上设置标记，以明确包含或排除特定政策中的这些资源。每个 Security Health Analytics 检测器都有一个专用标记类型，可让您通过添加安全标记 allow_finding-
type 从检测政策中排除已标记的资源。例如，要排除发现结果类型 SSL_NOT_ENFORCED，请使用安全标记 allow_ssl_not_enforced:true。此标记类型可为每个资源和检测器提供精细的控制。如需详细了解如何在 Security Health Analytics 中使用安全标记，请参阅使用安全标记标记资产和发现结果。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nYou can use security marks, or \"marks,\" in Security Command Center to annotate assets or\nfindings in Security Command Center and then search, select, or filter using the\nmark. You can provide ACL annotations on assets and findings using security\nmarks. Then, you can filter the assets and findings by these annotations for management, policy\napplication, or integration with your workflow. You can also use marks to add\npriority, access level, or sensitivity classifications.\n\nYou can add or update security marks only on assets that are supported\nby Security Command Center. For a list of the assets that Security Command Center\nsupports, see\n[Supported asset types in Security Command Center](/security-command-center/docs/supported-asset-types).\n\nBefore you begin\n\nTo add or change security marks, you must have an Identity and Access Management (IAM)\nrole that includes permissions for the kind of mark that you want to use:\n\n- Asset marks: **Asset Security Marks Writer** , `securitycenter.assetSecurityMarksWriter`\n- Finding marks: **Finding Security Marks Writer** , `securitycenter.findingSecurityMarksWriter`\n\n\nThe IAM roles for Security Command Center can be granted at the organization,\nfolder, or project level. Your ability to view, edit, create, or update findings, assets,\nand security sources depends on the level for which you are granted access. To learn more about\nSecurity Command Center roles, see [Access control](/security-command-center/docs/access-control).\n\nSecurity marks\n\nSecurity marks are unique to Security Command Center. IAM\npermissions apply to\nsecurity marks, and they are restricted to only users who have the appropriate\nSecurity Command Center roles. Reading and editing marks require the Security\nCenter Asset Security Marks Writer and Security Center Finding Security Marks\nWriter roles. These roles don't include permissions to access the underlying\nresource.\n\nSecurity marks enable you to add your business context for assets and findings.\nBecause IAM roles apply to security marks, they can be be used to\nfilter and enforce policies on assets and findings.\n\nSecurity marks are processed during batch scans---which run twice daily---and not in\nreal time. There may be a delay of 12 to 24 hours before security marks are\nprocessed and enforcement policies that resolve or reopen findings are applied.\n\nLabels and tags\n\nLabels and tags are similar kinds of metadata that you can use with\nSecurity Command Center, but they have a slightly different use and permissions\nmodel than security marks.\n\n[Labels](/resource-manager/docs/creating-managing-labels) are user-level\nannotations that are applied to specific resources and are supported across\nmultiple Google Cloud products. Labels are primarily used\nfor billing accounting and attribution.\n\nThere are two types of tags in Google Cloud:\n\n- [Network tags](/vpc/docs/add-remove-network-tags) are user-level annotations,\n specific to Compute Engine resources. Network tags are primarily used to\n define security groups, network segmentation, and firewall rules.\n\n- [Resource tags](/resource-manager/docs/tags/tags-overview), or tags, are\n key-value pairs that can be attached to an organization, folder, or project. You\n can use tags to conditionally allow or deny policies based on whether a resource\n has a specific tag.\n\nReading or updating labels and tags is tied to the permissions on the underlying\nresource. Labels and tags are ingested as part of the resource attributes in the\nSecurity Command Center assets display. You can search for specific label and\ntag presence, and specific keys and values, during post-processing of List API\nresults.\n\nAdding security marks to assets and findings\n\nYou can add security marks to all resources that are supported by\nSecurity Command Center, including all\n[asset types](/security-command-center/docs/how-to-use-security-command-center#assets) and\nfindings.\n\nMarks are visible in the Security Command Center API; for the Standard and Premium service tiers,\nmarks are also visible in the Google Cloud console. You can use marks to\nfilter assets and findings, define policy groups, or add business context\nto assets and findings. Asset marks are separate from finding marks. Asset marks\nare not automatically added to findings for assets.\n\nSecurity marks in the assets display Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nTo add security marks to assets in the Google Cloud console, follow these\nsteps:\n\n1.\n In the Google Cloud console, go to the **Assets** page of Security Command Center.\n\n\n [Go to Assets](https://console.cloud.google.com/security/command-center/assetsv2/resources)\n\n \u003cbr /\u003e\n\n2. From the project selector, select the project, folder, or\n organization that contains the assets you need to mark.\n\n3. On the assets display that appears, select the checkbox for each\n assets that you want to mark.\n\n4. Select **Set Security Marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify one or more security marks by adding **Key** and **Value** items.\n\n For example, if you want to mark projects that are in a production stage,\n add a key of \"stage\" and a value of \"prod\". Each select project then has\n the new `mark.stage: prod`, which you can use to filter them.\n7. To edit an existing mark, update text in the **Value** field. You can\n delete marks by clicking the trash icon next to the mark,\n *delete*.\n\n8. When you're finished adding marks, click **Save**.\n\nThe assets you selected are now associated with a mark. By default, marks\ndisplay as a column in the assets display.\n\nFor information on dedicated asset marks for Security Health Analytics detectors, see\n[Managing policies](#managing_policies) later on this page.\n\nAdd security marks to findings Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nThe following steps add security marks to findings by using the\nGoogle Cloud console. After adding security marks, you can use them to filter\nthe findings in the **Findings query results** panel.\n\nTo add security marks to findings:\n\n1. Go to the Security Command Center **Findings** page in the Google Cloud console.\n\n [Go to the Findings page](https://console.cloud.google.com/security/command-center/findings)\n2. Select the project or organization you want to review.\n\n3. In the **Findings query results** panel, select one or more findings\n to add a security mark to by selecting their checkboxes.\n\n4. Select **Set security marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify the security mark as **Key** and **Value** items.\n\n For example, if you want to mark findings that are part of the same incident,\n add a key of \"incident-number\" and a value of \"1234\". Each finding then has\n the new `mark.incident-number: 1234`.\n7. To edit an existing mark, update text in the **Value** field.\n\n8. To delete marks, click the trash icon next to the mark.\n *delete*\n\n9. When you're finished adding marks, click **Save**.\n\n| **Note:** A mark added to a finding is only applied to that specific finding. The mark is not applied to subsequent findings of the same type.\n\nManaging policies\n\nTo suppress findings, you can manually or programmatically mute\nindividual findings or create mute rules that automatically mute current *and*\nfuture findings based on filters you define. For more information, see [Mute\nfindings in Security Command Center](/security-command-center/docs/how-to-mute-findings).\n\nMuting findings is the recommended method when you don't want to review findings\nfor projects that are isolated or fall within acceptable business parameters.\n\nAlternatively, you can set marks on assets to explicitly include or exclude\nthose resources from specific policies. Each Security Health Analytics detector has a\ndedicated mark type that you can use to exclude marked resources from the\ndetection policy, by adding a security mark\n`allow_`\u003cvar translate=\"no\"\u003efinding-type\u003c/var\u003e. For example, to exclude the finding\ntype `SSL_NOT_ENFORCED`, use the security mark `allow_ssl_not_enforced:true`.\nThis mark type provides granularity of control for each resource and detector.\nFor more information about using security marks in Security Health Analytics, see\n[Marking assets and findings with security marks](/security-command-center/docs/how-to-use-security-health-analytics#security-marks).\n\nWhat's next\n\n- Learn how to [use Security Command Center in the Google Cloud console](/security-command-center/docs/how-to-use-security-command-center) to review assets and findings."]]
