您可以在機構、資料夾或專案層級授予 Security Command Center 的 IAM 角色。您能否查看、編輯、建立或更新發現項目、資產和安全來源，取決於獲准的存取層級。如要進一步瞭解 Security Command Center 角色，請參閱存取權控管。
安全標記
安全標記是 Security Command Center 的專屬功能。IAM 權限適用於安全性標記，且僅限具備適當 Security Command Center 角色的使用者。如要讀取及編輯標記，必須具備安全中心資產安全標記寫入者和安全中心發現項目安全標記寫入者角色。這些角色不包含存取基礎資源的權限。
安全標記可讓您為資產和發現項目新增業務背景資訊。
由於 IAM 角色適用於安全性標記，因此可用於篩選及強制執行資產和搜尋結果的政策。
讀取或更新標籤和標記的權限與基礎資源的權限相關。標籤和標記會併入 Security Command Center 資產顯示頁面的資源屬性。您可以在後續處理 List API 結果時，搜尋特定標籤和標記是否存在，以及特定鍵和值。
為資產和發現項目新增安全標記
您可以為 Security Command Center 支援的所有資源新增安全標記，包括所有資產類型和調查結果。
您可以在 Security Command Center API 中查看標記；如果是 Standard 和 Premium 服務層級，也可以在 Google Cloud 控制台中查看標記。您可以使用標記來篩選資產和調查結果、定義政策群組，或在資產和調查結果中新增商家背景資訊。資產標記與發現標記不同。系統不會自動將素材資源標記新增至素材資源的發現項目。
資產顯示畫面中的安全標記
如要在 Google Cloud 控制台中為資產新增安全標記，請按照下列步驟操作：
在 Google Cloud 控制台，前往 Security Command Center 的「資產」頁面。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-09 (世界標準時間)。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nYou can use security marks, or \"marks,\" in Security Command Center to annotate assets or\nfindings in Security Command Center and then search, select, or filter using the\nmark. You can provide ACL annotations on assets and findings using security\nmarks. Then, you can filter the assets and findings by these annotations for management, policy\napplication, or integration with your workflow. You can also use marks to add\npriority, access level, or sensitivity classifications.\n\nYou can add or update security marks only on assets that are supported\nby Security Command Center. For a list of the assets that Security Command Center\nsupports, see\n[Supported asset types in Security Command Center](/security-command-center/docs/supported-asset-types).\n\nBefore you begin\n\nTo add or change security marks, you must have an Identity and Access Management (IAM)\nrole that includes permissions for the kind of mark that you want to use:\n\n- Asset marks: **Asset Security Marks Writer** , `securitycenter.assetSecurityMarksWriter`\n- Finding marks: **Finding Security Marks Writer** , `securitycenter.findingSecurityMarksWriter`\n\n\nThe IAM roles for Security Command Center can be granted at the organization,\nfolder, or project level. Your ability to view, edit, create, or update findings, assets,\nand security sources depends on the level for which you are granted access. To learn more about\nSecurity Command Center roles, see [Access control](/security-command-center/docs/access-control).\n\nSecurity marks\n\nSecurity marks are unique to Security Command Center. IAM\npermissions apply to\nsecurity marks, and they are restricted to only users who have the appropriate\nSecurity Command Center roles. Reading and editing marks require the Security\nCenter Asset Security Marks Writer and Security Center Finding Security Marks\nWriter roles. These roles don't include permissions to access the underlying\nresource.\n\nSecurity marks enable you to add your business context for assets and findings.\nBecause IAM roles apply to security marks, they can be be used to\nfilter and enforce policies on assets and findings.\n\nSecurity marks are processed during batch scans---which run twice daily---and not in\nreal time. There may be a delay of 12 to 24 hours before security marks are\nprocessed and enforcement policies that resolve or reopen findings are applied.\n\nLabels and tags\n\nLabels and tags are similar kinds of metadata that you can use with\nSecurity Command Center, but they have a slightly different use and permissions\nmodel than security marks.\n\n[Labels](/resource-manager/docs/creating-managing-labels) are user-level\nannotations that are applied to specific resources and are supported across\nmultiple Google Cloud products. Labels are primarily used\nfor billing accounting and attribution.\n\nThere are two types of tags in Google Cloud:\n\n- [Network tags](/vpc/docs/add-remove-network-tags) are user-level annotations,\n specific to Compute Engine resources. Network tags are primarily used to\n define security groups, network segmentation, and firewall rules.\n\n- [Resource tags](/resource-manager/docs/tags/tags-overview), or tags, are\n key-value pairs that can be attached to an organization, folder, or project. You\n can use tags to conditionally allow or deny policies based on whether a resource\n has a specific tag.\n\nReading or updating labels and tags is tied to the permissions on the underlying\nresource. Labels and tags are ingested as part of the resource attributes in the\nSecurity Command Center assets display. You can search for specific label and\ntag presence, and specific keys and values, during post-processing of List API\nresults.\n\nAdding security marks to assets and findings\n\nYou can add security marks to all resources that are supported by\nSecurity Command Center, including all\n[asset types](/security-command-center/docs/how-to-use-security-command-center#assets) and\nfindings.\n\nMarks are visible in the Security Command Center API; for the Standard and Premium service tiers,\nmarks are also visible in the Google Cloud console. You can use marks to\nfilter assets and findings, define policy groups, or add business context\nto assets and findings. Asset marks are separate from finding marks. Asset marks\nare not automatically added to findings for assets.\n\nSecurity marks in the assets display Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nTo add security marks to assets in the Google Cloud console, follow these\nsteps:\n\n1.\n In the Google Cloud console, go to the **Assets** page of Security Command Center.\n\n\n [Go to Assets](https://console.cloud.google.com/security/command-center/assetsv2/resources)\n\n \u003cbr /\u003e\n\n2. From the project selector, select the project, folder, or\n organization that contains the assets you need to mark.\n\n3. On the assets display that appears, select the checkbox for each\n assets that you want to mark.\n\n4. Select **Set Security Marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify one or more security marks by adding **Key** and **Value** items.\n\n For example, if you want to mark projects that are in a production stage,\n add a key of \"stage\" and a value of \"prod\". Each select project then has\n the new `mark.stage: prod`, which you can use to filter them.\n7. To edit an existing mark, update text in the **Value** field. You can\n delete marks by clicking the trash icon next to the mark,\n *delete*.\n\n8. When you're finished adding marks, click **Save**.\n\nThe assets you selected are now associated with a mark. By default, marks\ndisplay as a column in the assets display.\n\nFor information on dedicated asset marks for Security Health Analytics detectors, see\n[Managing policies](#managing_policies) later on this page.\n\nAdd security marks to findings Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nThe following steps add security marks to findings by using the\nGoogle Cloud console. After adding security marks, you can use them to filter\nthe findings in the **Findings query results** panel.\n\nTo add security marks to findings:\n\n1. Go to the Security Command Center **Findings** page in the Google Cloud console.\n\n [Go to the Findings page](https://console.cloud.google.com/security/command-center/findings)\n2. Select the project or organization you want to review.\n\n3. In the **Findings query results** panel, select one or more findings\n to add a security mark to by selecting their checkboxes.\n\n4. Select **Set security marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify the security mark as **Key** and **Value** items.\n\n For example, if you want to mark findings that are part of the same incident,\n add a key of \"incident-number\" and a value of \"1234\". Each finding then has\n the new `mark.incident-number: 1234`.\n7. To edit an existing mark, update text in the **Value** field.\n\n8. To delete marks, click the trash icon next to the mark.\n *delete*\n\n9. When you're finished adding marks, click **Save**.\n\n| **Note:** A mark added to a finding is only applied to that specific finding. The mark is not applied to subsequent findings of the same type.\n\nManaging policies\n\nTo suppress findings, you can manually or programmatically mute\nindividual findings or create mute rules that automatically mute current *and*\nfuture findings based on filters you define. For more information, see [Mute\nfindings in Security Command Center](/security-command-center/docs/how-to-mute-findings).\n\nMuting findings is the recommended method when you don't want to review findings\nfor projects that are isolated or fall within acceptable business parameters.\n\nAlternatively, you can set marks on assets to explicitly include or exclude\nthose resources from specific policies. Each Security Health Analytics detector has a\ndedicated mark type that you can use to exclude marked resources from the\ndetection policy, by adding a security mark\n`allow_`\u003cvar translate=\"no\"\u003efinding-type\u003c/var\u003e. For example, to exclude the finding\ntype `SSL_NOT_ENFORCED`, use the security mark `allow_ssl_not_enforced:true`.\nThis mark type provides granularity of control for each resource and detector.\nFor more information about using security marks in Security Health Analytics, see\n[Marking assets and findings with security marks](/security-command-center/docs/how-to-use-security-health-analytics#security-marks).\n\nWhat's next\n\n- Learn how to [use Security Command Center in the Google Cloud console](/security-command-center/docs/how-to-use-security-command-center) to review assets and findings."]]
