This page explains how to manage Security Health Analytics findings using Security Command Center.
Security Health Analytics is a built-in service in Security Command Center that produces findings for your organization or projects. To view Security Health Analytics findings, it must be enabled in Security Command Center Services settings.
Findings from Security Health Analytics detectors are searchable in the Google Cloud console and using the Security Command Center API.
Scans start approximately one hour after Security Command Center is enabled and run in two modes: batch mode, which automatically runs once each day; and real-time mode, which runs scans against asset configuration changes. Security Health Analytics detectors that do not support real-time scanning mode are listed in Security Command Center Latency Overview.
The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.
Features by pricing tier
Security Health Analytics provides managed vulnerability assessment scanning that automatically detects the highest severity vulnerabilities and misconfigurations for your Google Cloud assets.
In Security Command Center's Standard tier, Security Health Analytics only includes a basic group of high-severity detectors.
The Premium tier includes the following Security Health Analytics features:
- All Security Health Analytics detectors.
- Compliance reporting for industry best practices and benchmarks.
- Attack exposure scores and attack paths on most Security Health Analytics findings.
Switching tiers
Most Security Health Analytics detectors are available only in the Security Command Center Premium tier. If you are a Premium customer and plan to switch to the Standard tier, it is recommended that you resolve all findings before changing your tier.
Findings generated by Premium detectors can't be automatically resolved in the Standard tier because, after downgrading or at the end of a Premium trial, Security Health Analytics no longer runs Premium detectors in your organization. These findings won't be updated and remain active. To manually mark findings inactive, go to the Findings page in the Google Cloud console.
Enable and disable detectors
The following Security Health Analytics detectors are not enabled by default:
BIGQUERY_TABLE_CMEK_DISABLED
BUCKET_CMEK_DISABLED
CLOUD_ASSET_API_DISABLED
DATAPROC_CMEK_DISABLED
DATASET_CMEK_DISABLED
DISK_CMEK_DISABLED
DISK_CSEK_DISABLED
NODEPOOL_BOOT_CMEK_DISABLED
PUBSUB_CMEK_DISABLED
SQL_CMEK_DISABLED
SQL_NO_ROOT_PASSWORD
SQL_WEAK_ROOT_PASSWORD
VPC_FLOW_LOGS_SETTINGS_NOT_RECOMMENDED
To turn on a detector, also known as a module, run the modules enable gcloud alpha command in the Google Cloud CLI at the organization level or the project level.
If you activated Security Command Center at the organization level, run the following:
gcloud alpha scc settings services modules enable \
--organization=ORGANIZATION_ID \
--service=SECURITY_HEALTH_ANALYTICS \
--module=DETECTOR_NAME
Replace the following:
- ORGANIZATION_ID: your organization ID
- DETECTOR_NAME: the name of the detector you want to enable
If you activated Security Command Center at the project level, run the following:
gcloud alpha scc settings services modules enable \
--project=PROJECT_ID \
--service=SECURITY_HEALTH_ANALYTICS \
--module=DETECTOR_NAME
Replace the following:
- PROJECT_ID: your project ID
- DETECTOR_NAME: the name of the detector you want to enable
To disable a detector, run the modules disable command at the organization level or the project level.
If you activated Security Command Center at the organization level, run the following:
gcloud alpha scc settings services modules disable \
--organization=ORGANIZATION_ID \
--service=SECURITY_HEALTH_ANALYTICS \
--module=DETECTOR_NAME
Replace the following:
- ORGANIZATION_ID: your organization ID
- DETECTOR_NAME: the name of the detector you want to disable
If you activated Security Command Center at the project level, run the following:
gcloud alpha scc settings services modules disable \
--project=PROJECT_ID \
--service=SECURITY_HEALTH_ANALYTICS \
--module=DETECTOR_NAME
Replace the following:
- PROJECT_ID: your project ID
- DETECTOR_NAME: the name of the detector you want to disable
Disabling detectors can impact the state of active findings. When a detector is disabled, existing findings are marked as inactive.
When you activate Security Command Center at the organization level, you can disable Security Health Analytics or specific detectors for specific folders or projects. If Security Health Analytics or detectors are turned off for folders and projects, any existing findings attached to assets in those resources are marked as inactive.
Filtering findings in Security Command Center
A large organization might have many vulnerability findings across their deployment to review, triage, and track. By using Security Command Center with the available filters, you can focus on the highest severity vulnerabilities across your organization, and review vulnerabilities by asset type, project, and more.
To view a complete list of Security Health Analytics detectors and findings, see the Security Health Analytics findings page.
Viewing Security Health Analytics findings by project
To view Security Health Analytics findings by project, do the following:
Go to Security Command Center in the Google Cloud console.
In the project selector at the top of the page, select the project for which you need to see the Security Health Analytics findings.
Click the Vulnerabilities page.
The Vulnerabilities page displays findings only for the project that you selected.
Viewing Security Health Analytics findings by finding type
To view Security Health Analytics findings by category, do the following:
Go to Security Command Center in the Google Cloud console.
To display Security Health Analytics findings, click the Vulnerabilities page.
In the Category column, select the finding type that you want to display findings for.
The Findings page loads and displays a list of findings that match the type you selected.
Viewing findings by asset type
To view Security Health Analytics findings for a specific asset type, do the following:
Go to the Security Command Center Findings page in the Google Cloud console.
In the Quick filters panel, select the following:
- In the Source display name section, select Security Health Analytics.
- Optional: In the Project ID section, select the ID of the project in which to view assets.
- In the Resource type section, select the resource type that you need to see.
The list of findings in the Findings query results panel updates to display only those findings that match your selections.
Viewing Security Health Analytics findings by attack exposure score
To view Security Health Analytics findings by attack exposure score, do the following:
Go to Security Command Center Findings page in the Google Cloud console.
Select your organization.
To the right of the Query preview panel, click Edit query.
At the top of the Query editor panel, click Add filter.
In the Select filter dialog, select **Finding > Source display name
Security Health Analytics**.
In the Select filter dialog, select Attack exposure.
In the Attack exposure greater than field, enter a score value.
Click Apply.
The filter statement is added to your query and the findings in the Findings query results panel are updated to show only findings with an attack exposure score that is greater than the value specified in the new filter statement.
Viewing Security Health Analytics findings by severity
To view Security Health Analytics findings by severity, do the following:
Go to Security Command Center in the Google Cloud console.
To display Security Health Analytics findings, click the Vulnerabilities page.
To sort findings by severity, click the Severity column header. Finding values are
HIGH
,MEDIUM
,LOW
.
For more information about finding types, see Vulnerabilities findings. Security Command Center also provides many built-in properties.
After you filter by the vulnerabilities that are important to you, you can view detailed information about the finding by selecting the vulnerability in Security Command Center. This information includes a description of the vulnerability and the risk, and recommendations for remediation.
Mute findings
To control the volume of findings in Security Command Center, you can manually or programmatically mute individual findings or create mute rules that automatically mute current and future findings based on filters you define.
Muted findings are hidden and silenced, but continue to be logged for audit and compliance purposes. You can view muted findings or unmute them at any time. To learn more, see Mute findings in Security Command Center.
Marking assets and findings with security marks
You can add custom properties to findings and assets in Security Command Center by using security marks. Security marks enable you to identify high-priority areas of interest like production projects, tag findings with bug and incident tracking numbers, and more.
For assets, you can add security marks only to those assets that Security Command Center supports. For the list of supported assets, see Supported asset types in Security Command Center.
Add assets to allowlists
Although it is not a recommended method, you can suppress unneeded findings by adding dedicated security marks to assets so that the Security Health Analytics detectors don't create security findings for those assets.
The recommended and most effective approach for controlling finding volume is to Mute findings. Mute findings that you don't need to review, because they are either for assets that are isolated or because the findings fall within acceptable business parameters.
When you apply dedicated security marks to assets, the assets are added to an allowlist in Security Health Analytics, which marks any findings for those assets as resolved during the next batch scan.
Dedicated security marks must be applied directly to assets, not findings, as described in How allowlists work later on this page. If you apply a mark to a finding, the underlying asset can still generate findings.
How allowlists work
Each Security Health Analytics detector has a dedicated mark type for allowlists, in
the form of allow_FINDING_TYPE:true
. Adding this
dedicated mark to an asset that is supported by Security Command Center
lets you exclude the asset from the detection policy.
For example, to exclude the finding type SSL_NOT_ENFORCED
, set the security
mark, allow_ssl_not_enforced:true
, on the related Cloud SQL instance.
The specified detector won't create findings for marked assets.
For a complete list of finding types, see the Security Health Analytics detectors list. To learn more about security marks and techniques for using them, see Using security marks.
Asset types
This section describes how security marks work for different assets.
Allowlist assets: When you add a dedicated mark to an asset, like a Cloud Storage bucket or firewall, the associated finding is marked as resolved when the next batch scan runs. The detector will not generate new findings or update existing findings for the asset until the mark is removed.
Allowlist projects: When you add a mark to a project resource, findings for which the project itself is the scanned, or target, resource are resolved. However, assets contained within the project, such as virtual machines or crypto keys, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.
Allowlist folders: When you add a mark to a folder resource, findings for which the folder itself is the scanned, or target, resource are resolved. However, assets contained within the folder, including projects, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.
Detectors that support multiple assets: If a detector supports more than one asset type, you must apply the dedicated mark to each asset. For instance, the detector,
KMS_PUBLIC_KEY
, supports two Cloud Key Management Service assets: CryptoKey and KeyRing. If you apply the markallow_kms_public_key:true
to the CryptoKey asset,KMS_PUBLIC_KEY
findings for that asset are resolved but can still be generated for the KeyRing asset.
Security marks are only updated during batch scans, not real-time scans. So, if a dedicated security mark is removed, and the asset has a vulnerability, it could take up to 24 hours before the mark is deleted and a finding is written.
Special-case detector: Customer Supplied Encryption Keys
The DISK_CSEK_DISABLED detector isn't on by default. To use this detector, you must mark the assets for which you want to use self-managed encryption keys.
To enable the DISK_CSEK_DISABLED detector for specific assets, apply the
security mark
enforce_customer_supplied_disk_encryption_keys
to the asset with a value of
true
.
Viewing active finding count by finding type
You can use the Google Cloud console or Google Cloud CLI commands to view active finding counts by finding type.
Console
The Google Cloud console enables you to view a count of active findings for each finding type.
To view Security Health Analytics findings by finding type, do the following:
Go to Security Command Center in the Google Cloud console.
To display Security Health Analytics findings, click the Vulnerabilities page.
To sort findings by the number of active findings for each finding type, click the Active column header.
gcloud
To use the gcloud CLI to get a count of all active findings, you query Security Command Center to get the Security Health Analytics source ID. Then you use the source ID to query the active findings count.
Step 1: Get the source ID
To complete this step, you need your organization ID. To get your
organization ID, run gcloud organizations list
and note the number next to
the organization name.
To get the Security Health Analytics source ID, run one of the following commands, depending on whether you activated Security Command Center at the organization level or the project level:
gcloud scc sources describe organizations/ORGANIZATION_ID \
--source-display-name='Security Health Analytics'
gcloud scc sources describe projects/PROJECT_ID \
--source-display-name='Security Health Analytics'
If you haven't already enabled the Security Command Center API, you are prompted to enable it. When the Security Command Center API is enabled, run the previous command again. The command should display output like the following:
description: Scans for deviations from a GCP security baseline.
displayName: Security Health Analytics
name: organizations/ORGANIZATION_ID/sources/SOURCE_ID
Note the SOURCE_ID to use in the next step.
Step 2: Get the active findings count
Use the SOURCE_ID you noted in the previous step to filter findings from Security Health Analytics. The following gcloud CLI commands return a count of findings by category.
If you activated Security Command Center at the organization level, run the following:
gcloud scc findings group organizations/ORGANIZATION_ID/sources/SOURCE_ID \
--group-by=category --page-size=PAGE_SIZE
If you activated Security Command Center at the project level, run the following:
gcloud scc findings group projects/PROJECT_ID/sources/SOURCE_ID \
--group-by=category --page-size=PAGE_SIZE
You can set the page-size to any value up to 1000. The command should display output like the following, with results from your particular organization:
groupByResults:
- count: '1'
properties:
category: MFA_NOT_ENFORCED
- count: '3'
properties:
category: ADMIN_SERVICE_ACCOUNT
- count: '2'
properties:
category: API_KEY_APIS_UNRESTRICTED
- count: '1'
properties:
category: API_KEY_APPS_UNRESTRICTED
- count: '2'
properties:
category: API_KEY_EXISTS
- count: '10'
properties:
category: AUDIT_CONFIG_NOT_MONITORED
- count: '10'
properties:
category: AUDIT_LOGGING_DISABLED
- count: '1'
properties:
category: AUTO_UPGRADE_DISABLED
- count: '10'
properties:
category: BUCKET_IAM_NOT_MONITORED
- count: '10'
properties:
category: BUCKET_LOGGING_DISABLED
nextPageToken: TOKEN
readTime: '2019-08-05T21:56:13.862Z'
totalSize: 50
Programmatically manage findings
Using the Google Cloud CLI with the Security Command Center SDK enables you to automate almost anything you can do with Security Command Center in the Google Cloud console. You can also remediate many findings using the gcloud CLI. For more information, review the documentation for the resource types described in each finding:
- Listing security findings
- Creating, modifying, and querying security marks
- Creating and updating security findings
- Creating, updating, and listing finding sources
- Configuring organization settings
To export or list assets programmatically, use the Cloud Asset Inventory API. For more information, see Export asset history and metadata.
The asset methods and fields of the Security Command Center API are deprecated and will be removed on or after June 26, 2024.
Until they are removed, users who activated Security Command Center before June 26, 2023 can use the asset methods of the Security Command Center API to list assets, but these methods support only the assets that Security Command Center supports.
For information about using the deprecated asset API methods, see listing assets.
Scanning projects protected by a service perimeter
This feature is only available if you activate Security Command Center Premium tier at the organization level.
If you have a service perimeter that blocks access to certain projects and services, you must grant the Security Command Center service account inbound access to that service perimeter. Otherwise, Security Health Analytics can't produce findings related to the protected projects and services.
The service account's identifier is an email address with the following format:
service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com
Replace ORGANIZATION_ID with the numerical identifier of your organization.
To grant inbound access to the Security Command Center service account, follow these steps.
Go to VPC Service Controls.
On the toolbar, select your Google Cloud organization.
In the drop-down list, select the access policy that contains the service perimeter you want to grant access to.
The service perimeters associated with the access policy appear in the list.
Click the name of the service perimeter.
Click
Edit perimeterIn the navigation menu, click Ingress Policy.
Click Add rule.
Configure the rule as follows:
FROM attributes of the API client
- For Source, select All sources.
- For Identity, select Selected identities.
- In the Add User/Service Account field, click Select.
- Enter the service account email address. If you have both organization-level and project-level service accounts, add both of them.
- Click Save.
TO attributes of GCP services/resources
-
For Project, select All projects.
For Services, select All services.
In the navigation menu, click Save.
Services that Security Health Analytics needs to access
If a service perimeter restricts access to a service, Security Health Analytics can't produce findings for that service. Security Health Analytics needs access to the following services:
- BigQuery API
- Binary Authorization API
- Cloud Logging API
- Cloud Monitoring API
- Compute Engine API
- Kubernetes Engine API
For more information, see Configuring ingress and egress policies.
What's next
- Learn about Security Health Analytics detectors and findings.
- Read recommendations for remediating Security Health Analytics findings.
- Learn how to use Security Command Center security marks.
- Learn more about using Security Command Center in the Google Cloud console to review assets and findings.