Security Command Center の IAM ロールは、組織レベル、フォルダレベル、またはプロジェクト レベルで付与できます。検出結果、アセット、セキュリティ ソースを表示、編集、作成、更新する権限は、アクセス権が付与されているレベルによって異なります。Security Command Center のロールの詳細については、アクセス制御をご覧ください。
セキュリティ マーク
セキュリティ マークは Security Command Center に固有のものです。IAM 権限はセキュリティ マークに適用され、適切な Security Command Center ロールを持つユーザーだけに制限されます。マークの読み取りと編集には、セキュリティ センターのアセット セキュリティ マーク編集者とセキュリティ センターの検出結果セキュリティ マーク編集者のロールが必要です。これらのロールには、基盤となるリソースにアクセスするための権限は含まれていません。
ラベルとタグの読み取りと更新は、基盤となるリソースの権限に関連付けられています。ラベルとタグは、Security Command Center アセット表示のリソース属性の一部として取り込まれます。List API の結果の後処理中には、特定のラベルやタグの存在、特定のキーや値を検索できます。
アセットと検出結果にセキュリティ マークを追加する
Security Command Center でサポートされているすべてのリソース（すべてのアセットタイプや検出結果など）にセキュリティ マークを追加できます。
マークは Google Cloud コンソールと Security Command Center API の出力に表示され、ポリシー グループのフィルタリングと定義、アセットと検出結果へのビジネス コンテキストの追加に使用できます。アセットマークは検出結果マークとは別のものです。アセットマークは、アセットの検出結果に自動的には追加されません。
アセットに表示されるセキュリティ マーク
[アセット] ページでアセットにセキュリティ マークを追加する手順は次のとおりです。
Google Cloud コンソールで、Security Command Center の [アセット] ページに移動します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-21 UTC。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nYou can use security marks, or \"marks,\" in Security Command Center to annotate assets or\nfindings in Security Command Center and then search, select, or filter using the\nmark. You can provide ACL annotations on assets and findings using security\nmarks. Then, you can filter the assets and findings by these annotations for management, policy\napplication, or integration with your workflow. You can also use marks to add\npriority, access level, or sensitivity classifications.\n\nYou can add or update security marks only on assets that are supported\nby Security Command Center. For a list of the assets that Security Command Center\nsupports, see\n[Supported asset types in Security Command Center](/security-command-center/docs/supported-asset-types).\n\nBefore you begin\n\nTo add or change security marks, you must have an Identity and Access Management (IAM)\nrole that includes permissions for the kind of mark that you want to use:\n\n- Asset marks: **Asset Security Marks Writer** , `securitycenter.assetSecurityMarksWriter`\n- Finding marks: **Finding Security Marks Writer** , `securitycenter.findingSecurityMarksWriter`\n\n\nThe IAM roles for Security Command Center can be granted at the organization,\nfolder, or project level. Your ability to view, edit, create, or update findings, assets,\nand security sources depends on the level for which you are granted access. To learn more about\nSecurity Command Center roles, see [Access control](/security-command-center/docs/access-control).\n\nSecurity marks\n\nSecurity marks are unique to Security Command Center. IAM\npermissions apply to\nsecurity marks, and they are restricted to only users who have the appropriate\nSecurity Command Center roles. Reading and editing marks require the Security\nCenter Asset Security Marks Writer and Security Center Finding Security Marks\nWriter roles. These roles don't include permissions to access the underlying\nresource.\n\nSecurity marks enable you to add your business context for assets and findings.\nBecause IAM roles apply to security marks, they can be be used to\nfilter and enforce policies on assets and findings.\n\nSecurity marks are processed during batch scans---which run twice daily---and not in\nreal time. There may be a delay of 12 to 24 hours before security marks are\nprocessed and enforcement policies that resolve or reopen findings are applied.\n\nLabels and tags\n\nLabels and tags are similar kinds of metadata that you can use with\nSecurity Command Center, but they have a slightly different use and permissions\nmodel than security marks.\n\n[Labels](/resource-manager/docs/creating-managing-labels) are user-level\nannotations that are applied to specific resources and are supported across\nmultiple Google Cloud products. Labels are primarily used\nfor billing accounting and attribution.\n\nThere are two types of tags in Google Cloud:\n\n- [Network tags](/vpc/docs/add-remove-network-tags) are user-level annotations,\n specific to Compute Engine resources. Network tags are primarily used to\n define security groups, network segmentation, and firewall rules.\n\n- [Resource tags](/resource-manager/docs/tags/tags-overview), or tags, are\n key-value pairs that can be attached to an organization, folder, or project. You\n can use tags to conditionally allow or deny policies based on whether a resource\n has a specific tag.\n\nReading or updating labels and tags is tied to the permissions on the underlying\nresource. Labels and tags are ingested as part of the resource attributes in the\nSecurity Command Center assets display. You can search for specific label and\ntag presence, and specific keys and values, during post-processing of List API\nresults.\n\nAdding security marks to assets and findings\n\nYou can add security marks to all resources that are supported by\nSecurity Command Center, including all\n[asset types](/security-command-center/docs/how-to-use-security-command-center#assets) and\nfindings.\n\nMarks are visible in the Security Command Center API; for the Standard and Premium service tiers,\nmarks are also visible in the Google Cloud console. You can use marks to\nfilter assets and findings, define policy groups, or add business context\nto assets and findings. Asset marks are separate from finding marks. Asset marks\nare not automatically added to findings for assets.\n\nSecurity marks in the assets display Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nTo add security marks to assets in the Google Cloud console, follow these\nsteps:\n\n1.\n In the Google Cloud console, go to the **Assets** page of Security Command Center.\n\n\n [Go to Assets](https://console.cloud.google.com/security/command-center/assetsv2/resources)\n\n \u003cbr /\u003e\n\n2. From the project selector, select the project, folder, or\n organization that contains the assets you need to mark.\n\n3. On the assets display that appears, select the checkbox for each\n assets that you want to mark.\n\n4. Select **Set Security Marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify one or more security marks by adding **Key** and **Value** items.\n\n For example, if you want to mark projects that are in a production stage,\n add a key of \"stage\" and a value of \"prod\". Each select project then has\n the new `mark.stage: prod`, which you can use to filter them.\n7. To edit an existing mark, update text in the **Value** field. You can\n delete marks by clicking the trash icon next to the mark,\n *delete*.\n\n8. When you're finished adding marks, click **Save**.\n\nThe assets you selected are now associated with a mark. By default, marks\ndisplay as a column in the assets display.\n\nFor information on dedicated asset marks for Security Health Analytics detectors, see\n[Managing policies](#managing_policies) later on this page.\n\nAdd security marks to findings Standard and Premium [service tiers](/security-command-center/docs/service-tiers)\n\nThe following steps add security marks to findings by using the\nGoogle Cloud console. After adding security marks, you can use them to filter\nthe findings in the **Findings query results** panel.\n\nTo add security marks to findings:\n\n1. Go to the Security Command Center **Findings** page in the Google Cloud console.\n\n [Go to the Findings page](https://console.cloud.google.com/security/command-center/findings)\n2. Select the project or organization you want to review.\n\n3. In the **Findings query results** panel, select one or more findings\n to add a security mark to by selecting their checkboxes.\n\n4. Select **Set security marks**.\n\n5. In the **Security Marks** dialog that appears, click **Add mark**.\n\n6. Specify the security mark as **Key** and **Value** items.\n\n For example, if you want to mark findings that are part of the same incident,\n add a key of \"incident-number\" and a value of \"1234\". Each finding then has\n the new `mark.incident-number: 1234`.\n7. To edit an existing mark, update text in the **Value** field.\n\n8. To delete marks, click the trash icon next to the mark.\n *delete*\n\n9. When you're finished adding marks, click **Save**.\n\n| **Note:** A mark added to a finding is only applied to that specific finding. The mark is not applied to subsequent findings of the same type.\n\nManaging policies\n\nTo suppress findings, you can manually or programmatically mute\nindividual findings or create mute rules that automatically mute current *and*\nfuture findings based on filters you define. For more information, see [Mute\nfindings in Security Command Center](/security-command-center/docs/how-to-mute-findings).\n\nMuting findings is the recommended method when you don't want to review findings\nfor projects that are isolated or fall within acceptable business parameters.\n\nAlternatively, you can set marks on assets to explicitly include or exclude\nthose resources from specific policies. Each Security Health Analytics detector has a\ndedicated mark type that you can use to exclude marked resources from the\ndetection policy, by adding a security mark\n`allow_`\u003cvar translate=\"no\"\u003efinding-type\u003c/var\u003e. For example, to exclude the finding\ntype `SSL_NOT_ENFORCED`, use the security mark `allow_ssl_not_enforced:true`.\nThis mark type provides granularity of control for each resource and detector.\nFor more information about using security marks in Security Health Analytics, see\n[Marking assets and findings with security marks](/security-command-center/docs/how-to-use-security-health-analytics#security-marks).\n\nWhat's next\n\n- Learn how to [use Security Command Center in the Google Cloud console](/security-command-center/docs/how-to-use-security-command-center) to review assets and findings."]]
