Using Security Health Analytics

Note: This feature is available for both Security Command Center Premium and Standard tiers, though some functionality may be limited in the Standard tier.

This page explains how to manage Security Health Analytics findings using Security Command Center.

Security Health Analytics is a built-in service in Security Command Center that produces findings for your organization or projects. To view Security Health Analytics findings, it must be enabled in Security Command Center Services settings.

Findings from Security Health Analytics detectors are searchable in the Google Cloud console and using the Security Command Center API.

Scans start approximately one hour after Security Command Center is enabled and run in two modes: batch mode, which automatically runs once each day; and real-time mode, which runs scans against asset configuration changes. Security Health Analytics detectors that do not support real-time scanning mode are listed in Security Command Center Latency Overview.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.

Features by pricing tier

Security Health Analytics provides managed vulnerability assessment scanning that automatically detects the highest severity vulnerabilities and misconfigurations for your Google Cloud assets.

In Security Command Center's Standard tier, Security Health Analytics only includes a basic group of high-severity detectors.

The Premium tier includes the following Security Health Analytics features:

• All Security Health Analytics detectors.
• Compliance reporting for industry best practices and benchmarks.
• Attack exposure scores and attack paths on most Security Health Analytics findings.

Switching tiers

Most Security Health Analytics detectors are available only in the Security Command Center Premium tier. If you are a Premium customer and plan to switch to the Standard tier, it is recommended that you resolve all findings before changing your tier.

Findings generated by Premium detectors can't be automatically resolved in the Standard tier because, after downgrading or at the end of a Premium trial, Security Health Analytics no longer runs Premium detectors in your organization. These findings won't be updated and remain active. To manually mark findings inactive, go to the Findings page in the Google Cloud console.

Enable and disable detectors

The following Security Health Analytics detectors are not enabled by default:

• BIGQUERY_TABLE_CMEK_DISABLED
• BUCKET_CMEK_DISABLED
• CLOUD_ASSET_API_DISABLED
• DATAPROC_CMEK_DISABLED
• DATASET_CMEK_DISABLED
• DISK_CMEK_DISABLED
• DISK_CSEK_DISABLED
• NODEPOOL_BOOT_CMEK_DISABLED
• PUBSUB_CMEK_DISABLED
• SQL_CMEK_DISABLED
• SQL_NO_ROOT_PASSWORD
• SQL_WEAK_ROOT_PASSWORD
• VPC_FLOW_LOGS_SETTINGS_NOT_RECOMMENDED

To turn on a detector, also known as a module, run the modules enable gcloud alpha command in the Google Cloud CLI at the organization level or the project level.

Note: This command is not used for DISK_CSEK_DISABLED, which must be enabled by using a dedicated security mark, as described in Special-case detector later on this page.

If you activated Security Command Center at the organization level, run the following:

  gcloud alpha scc settings services modules enable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

• ORGANIZATION_ID: your organization ID
• DETECTOR_NAME: the name of the detector you want to enable

If you activated Security Command Center at the project level, run the following:

  gcloud alpha scc settings services modules enable \
    --project=PROJECT_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

• PROJECT_ID: your project ID
• DETECTOR_NAME: the name of the detector you want to enable

To disable a detector, run the modules disable command at the organization level or the project level.

If you activated Security Command Center at the organization level, run the following:

  gcloud alpha scc settings services modules disable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

• ORGANIZATION_ID: your organization ID
• DETECTOR_NAME: the name of the detector you want to disable

If you activated Security Command Center at the project level, run the following:

  gcloud alpha scc settings services modules disable \
    --project=PROJECT_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

• PROJECT_ID: your project ID
• DETECTOR_NAME: the name of the detector you want to disable

Disabling detectors can impact the state of active findings. When a detector is disabled, existing findings are marked as inactive.

When you activate Security Command Center at the organization level, you can disable Security Health Analytics or specific detectors for specific folders or projects. If Security Health Analytics or detectors are turned off for folders and projects, any existing findings attached to assets in those resources are marked as inactive.

Filtering findings in Security Command Center

A large organization might have many vulnerability findings across their deployment to review, triage, and track. By using Security Command Center with the available filters, you can focus on the highest severity vulnerabilities across your organization, and review vulnerabilities by asset type, project, and more.

To view a complete list of Security Health Analytics detectors and findings, see the Security Health Analytics findings page.

Viewing Security Health Analytics findings by project

To view Security Health Analytics findings by project, do the following:

1. Go to Security Command Center in the Google Cloud console.

   Go to Security Command Center

2. In the project selector at the top of the page, select the project for which you need to see the Security Health Analytics findings.

3. Click the Vulnerabilities page.

The Vulnerabilities page displays findings only for the project that you selected.

Viewing Security Health Analytics findings by finding type

To view Security Health Analytics findings by category, do the following:

1. Go to Security Command Center in the Google Cloud console.

   Go to Security Command Center

2. To display Security Health Analytics findings, click the Vulnerabilities page.

3. In the Category column, select the finding type that you want to display findings for.

The Findings page loads and displays a list of findings that match the type you selected.

Viewing findings by asset type

To view Security Health Analytics findings for a specific asset type, do the following:

1. Go to the Security Command Center Findings page in the Google Cloud console.

   Go to Findings

2. In the Quick filters panel, select the following:

   • In the Source display name section, select Security Health Analytics.
   • Optional: In the Project ID section, select the ID of the project in which to view assets.
   • In the Resource type section, select the resource type that you need to see.

The list of findings in the Findings query results panel updates to display only those findings that match your selections.

Viewing Security Health Analytics findings by attack exposure score

To view Security Health Analytics findings by attack exposure score, do the following:

1. Go to Security Command Center Findings page in the Google Cloud console.

   Go to Findings

2. Select your organization.

3. To the right of the Query preview panel, click Edit query.

4. At the top of the Query editor panel, click Add filter.

5. In the Select filter dialog, select **Finding > Source display name

   Security Health Analytics**.

6. In the Select filter dialog, select Attack exposure.

7. In the Attack exposure greater than field, enter a score value.

8. Click Apply.

   The filter statement is added to your query and the findings in the Findings query results panel are updated to show only findings with an attack exposure score that is greater than the value specified in the new filter statement.

Viewing Security Health Analytics findings by severity

To view Security Health Analytics findings by severity, do the following:

1. Go to Security Command Center in the Google Cloud console.

   Go to Security Command Center

2. To display Security Health Analytics findings, click the Vulnerabilities page.

3. To sort findings by severity, click the Severity column header. Finding values are HIGH, MEDIUM, LOW.

For more information about finding types, see Vulnerabilities findings. Security Command Center also provides many built-in properties.

After you filter by the vulnerabilities that are important to you, you can view detailed information about the finding by selecting the vulnerability in Security Command Center. This information includes a description of the vulnerability and the risk, and recommendations for remediation.

Mute findings

To control the volume of findings in Security Command Center, you can manually or programmatically mute individual findings or create mute rules that automatically mute current and future findings based on filters you define.

Muted findings are hidden and silenced, but continue to be logged for audit and compliance purposes. You can view muted findings or unmute them at any time. To learn more, see Mute findings in Security Command Center.

Marking assets and findings with security marks

You can add custom properties to findings and assets in Security Command Center by using security marks. Security marks enable you to identify high-priority areas of interest like production projects, tag findings with bug and incident tracking numbers, and more.

For assets, you can add security marks only to those assets that Security Command Center supports. For the list of supported assets, see Supported asset types in Security Command Center.

Add assets to allowlists

Limited support: This feature is available only in instances of Security Command Center that were activated before June 26, 2023. If your activation of Security Command Center began on or after June 26, 2023, use the mute feature to suppress findings for certain assets.

For more information, see Mute findings in Security Command Center

Although it is not a recommended method, you can suppress unneeded findings by adding dedicated security marks to assets so that the Security Health Analytics detectors don't create security findings for those assets.

The recommended and most effective approach for controlling finding volume is to Mute findings. Mute findings that you don't need to review, because they are either for assets that are isolated or because the findings fall within acceptable business parameters.

When you apply dedicated security marks to assets, the assets are added to an allowlist in Security Health Analytics, which marks any findings for those assets as resolved during the next batch scan.

Dedicated security marks must be applied directly to assets, not findings, as described in How allowlists work later on this page. If you apply a mark to a finding, the underlying asset can still generate findings.

How allowlists work

Each Security Health Analytics detector has a dedicated mark type for allowlists, in the form of allow_FINDING_TYPE:true. Adding this dedicated mark to an asset that is supported by Security Command Center lets you exclude the asset from the detection policy.

For example, to exclude the finding type SSL_NOT_ENFORCED, set the security mark, allow_ssl_not_enforced:true, on the related Cloud SQL instance. The specified detector won't create findings for marked assets.

Note: Assets on allowlists are still scanned by detectors, but findings are suppressed and not written to Security Command Center.

For a complete list of finding types, see the Security Health Analytics detectors list. To learn more about security marks and techniques for using them, see Using security marks.

Asset types

This section describes how security marks work for different assets.

• Allowlist assets: When you add a dedicated mark to an asset, like a Cloud Storage bucket or firewall, the associated finding is marked as resolved when the next batch scan runs. The detector will not generate new findings or update existing findings for the asset until the mark is removed.

• Allowlist projects: When you add a mark to a project resource, findings for which the project itself is the scanned, or target, resource are resolved. However, assets contained within the project, such as virtual machines or crypto keys, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.

• Allowlist folders: When you add a mark to a folder resource, findings for which the folder itself is the scanned, or target, resource are resolved. However, assets contained within the folder, including projects, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.

• Detectors that support multiple assets: If a detector supports more than one asset type, you must apply the dedicated mark to each asset. For instance, the detector, KMS_PUBLIC_KEY, supports two Cloud Key Management Service assets: CryptoKey and KeyRing. If you apply the mark allow_kms_public_key:true to the CryptoKey asset, KMS_PUBLIC_KEY findings for that asset are resolved but can still be generated for the KeyRing asset.

Security marks are only updated during batch scans, not real-time scans. So, if a dedicated security mark is removed, and the asset has a vulnerability, it could take up to 24 hours before the mark is deleted and a finding is written.

Special-case detector: Customer Supplied Encryption Keys

The DISK_CSEK_DISABLED detector isn't on by default. To use this detector, you must mark the assets for which you want to use self-managed encryption keys.

To enable the DISK_CSEK_DISABLED detector for specific assets, apply the security mark enforce_customer_supplied_disk_encryption_keys to the asset with a value of true.

Viewing active finding count by finding type

You can use the Google Cloud console or Google Cloud CLI commands to view active finding counts by finding type.

Console

The Google Cloud console enables you to view a count of active findings for each finding type.

To view Security Health Analytics findings by finding type, do the following:

1. Go to Security Command Center in the Google Cloud console.

   Go to Security Command Center

2. To display Security Health Analytics findings, click the Vulnerabilities page.

3. To sort findings by the number of active findings for each finding type, click the Active column header.

gcloud

To use the gcloud CLI to get a count of all active findings, you query Security Command Center to get the Security Health Analytics source ID. Then you use the source ID to query the active findings count.

Step 1: Get the source ID

To complete this step, you need your organization ID. To get your organization ID, run gcloud organizations list and note the number next to the organization name.

To get the Security Health Analytics source ID, run one of the following commands, depending on whether you activated Security Command Center at the organization level or the project level:

gcloud scc sources describe organizations/ORGANIZATION_ID \
  --source-display-name='Security Health Analytics'

gcloud scc sources describe projects/PROJECT_ID \
  --source-display-name='Security Health Analytics'

If you haven't already enabled the Security Command Center API, you are prompted to enable it. When the Security Command Center API is enabled, run the previous command again. The command should display output like the following:

description: Scans for deviations from a GCP security baseline.
displayName: Security Health Analytics
name: organizations/ORGANIZATION_ID/sources/SOURCE_ID

Note the SOURCE_ID to use in the next step.

Step 2: Get the active findings count

Use the SOURCE_ID you noted in the previous step to filter findings from Security Health Analytics. The following gcloud CLI commands return a count of findings by category.

If you activated Security Command Center at the organization level, run the following:

gcloud scc findings group organizations/ORGANIZATION_ID/sources/SOURCE_ID \
 --group-by=category --page-size=PAGE_SIZE

If you activated Security Command Center at the project level, run the following:

gcloud scc findings group projects/PROJECT_ID/sources/SOURCE_ID \
 --group-by=category --page-size=PAGE_SIZE

You can set the page-size to any value up to 1000. The command should display output like the following, with results from your particular organization:

groupByResults:
- count: '1'
  properties:
    category: MFA_NOT_ENFORCED
- count: '3'
  properties:
    category: ADMIN_SERVICE_ACCOUNT
- count: '2'
  properties:
    category: API_KEY_APIS_UNRESTRICTED
- count: '1'
  properties:
    category: API_KEY_APPS_UNRESTRICTED
- count: '2'
  properties:
    category: API_KEY_EXISTS
- count: '10'
  properties:
    category: AUDIT_CONFIG_NOT_MONITORED
- count: '10'
  properties:
    category: AUDIT_LOGGING_DISABLED
- count: '1'
  properties:
    category: AUTO_UPGRADE_DISABLED
- count: '10'
  properties:
    category: BUCKET_IAM_NOT_MONITORED
- count: '10'
  properties:
    category: BUCKET_LOGGING_DISABLED
nextPageToken: TOKEN
      readTime: '2019-08-05T21:56:13.862Z'
      totalSize: 50

Programmatically manage findings

Using the Google Cloud CLI with the Security Command Center SDK enables you to automate almost anything you can do with Security Command Center in the Google Cloud console. You can also remediate many findings using the gcloud CLI. For more information, review the documentation for the resource types described in each finding:

• Listing security findings
• Creating, modifying, and querying security marks
• Creating and updating security findings
• Creating, updating, and listing finding sources
• Configuring organization settings

To export or list assets programmatically, use the Cloud Asset Inventory API. For more information, see Export asset history and metadata.

The asset methods and fields of the Security Command Center API are deprecated and will be removed on or after June 26, 2024.

Until they are removed, users who activated Security Command Center before June 26, 2023 can use the asset methods of the Security Command Center API to list assets, but these methods support only the assets that Security Command Center supports.

For information about using the deprecated asset API methods, see listing assets.

Scanning projects protected by a service perimeter

This feature is only available if you activate Security Command Center Premium tier at the organization level.

If you have a service perimeter that blocks access to certain projects and services, you must grant the Security Command Center service account inbound access to that service perimeter. Otherwise, Security Health Analytics can't produce findings related to the protected projects and services.

Note: Security Command Center provides error detectors, which report configuration errors that prevent Security Command Center and its services from working properly. If you have a VPC Service Controls Restriction (VPC_SC_RESTRICTION) error finding, see VPC Service Controls Restriction.

The service account's identifier is an email address with the following format:

[e-mail]

Replace ORGANIZATION_ID with the numerical identifier of your organization.

To grant inbound access to the Security Command Center service account, follow these steps.

1. Go to VPC Service Controls.

   Go to VPC Service Controls

2. On the toolbar, select your Google Cloud organization.

   

3. In the drop-down list, select the access policy that contains the service perimeter you want to grant access to.

   

   The service perimeters associated with the access policy appear in the list.

4. Click the name of the service perimeter.

5. Click Edit perimeter

6. In the navigation menu, click Ingress Policy.

7. Click Add rule.

8. Configure the rule as follows:

   FROM attributes of the API client

   1. For Source, select All sources.
   2. For Identity, select Selected identities.
   3. In the Add User/Service Account field, click Select.
   4. Enter the service account email address. If you have both organization-level and project-level service accounts, add both of them.
   5. Click Save.

   TO attributes of GCP services/resources

   1. For Project, select All projects.

   2. For Services, select All services.

      Note: If you want to narrow down the list of services to only the ones that Security Health Analytics needs access to, see the list of services later in this section.

9. In the navigation menu, click Save.

Services that Security Health Analytics needs to access

If a service perimeter restricts access to a service, Security Health Analytics can't produce findings for that service. Security Health Analytics needs access to the following services:

• BigQuery API
• Binary Authorization API
• Cloud Logging API
• Cloud Monitoring API
• Compute Engine API
• Kubernetes Engine API

For more information, see Configuring ingress and egress policies.

What's next

• Learn about Security Health Analytics detectors and findings.
• Read recommendations for remediating Security Health Analytics findings.
• Learn how to use Security Command Center security marks.
• Learn more about using Security Command Center in the Google Cloud console to review assets and findings.