Using Security Health Analytics

This page explains how to manage Security Health Analytics findings using Security Command Center.

Security Health Analytics is a built-in service in Security Command Center that produces findings for your organization or projects. To view Security Health Analytics findings, it must be enabled in Security Command Center Services settings.

Findings from Security Health Analytics detectors are searchable in the Google Cloud console and using the Security Command Center API.

Scans start approximately one hour after Security Command Center is enabled and run in two modes: batch mode, which automatically runs once each day; and real-time mode, which runs scans against asset configuration changes. Security Health Analytics detectors that do not support real-time scanning mode are listed in Security Command Center Latency Overview.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.

Features by pricing tier

Security Health Analytics provides managed vulnerability assessment scanning that automatically detects the highest severity vulnerabilities and misconfigurations for your Google Cloud assets.

In Security Command Center's Standard tier, Security Health Analytics only includes a basic group of high-severity detectors.

The Premium tier includes the following Security Health Analytics features:

Switching tiers

Most Security Health Analytics detectors are available only in the Security Command Center Premium tier. If you are a Premium customer and plan to switch to the Standard tier, it is recommended that you resolve all findings before changing your tier.

Findings generated by Premium detectors automatically have their state set to INACTIVE after downgrading or at the end of a Premium trial.

Enable and disable detectors

The following Security Health Analytics detectors are not enabled by default:

  • BIGQUERY_TABLE_CMEK_DISABLED
  • BUCKET_CMEK_DISABLED
  • CLOUD_ASSET_API_DISABLED
  • DATAPROC_CMEK_DISABLED
  • DATASET_CMEK_DISABLED
  • DISK_CMEK_DISABLED
  • DISK_CSEK_DISABLED
  • NODEPOOL_BOOT_CMEK_DISABLED
  • PUBSUB_CMEK_DISABLED
  • SQL_CMEK_DISABLED
  • SQL_NO_ROOT_PASSWORD
  • SQL_WEAK_ROOT_PASSWORD
  • VPC_FLOW_LOGS_SETTINGS_NOT_RECOMMENDED

To turn on a detector, also known as a module, run the modules enable gcloud alpha command in the Google Cloud CLI at the organization level or the project level.

If you activated Security Command Center at the organization level, run the following:

  gcloud alpha scc settings services modules enable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

  • ORGANIZATION_ID: your organization ID
  • DETECTOR_NAME: the name of the detector you want to enable

If you activated Security Command Center at the project level, run the following:

  gcloud alpha scc settings services modules enable \
    --project=PROJECT_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

  • PROJECT_ID: your project ID
  • DETECTOR_NAME: the name of the detector you want to enable

To disable a detector, run the modules disable command at the organization level or the project level.

If you activated Security Command Center at the organization level, run the following:

  gcloud alpha scc settings services modules disable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

  • ORGANIZATION_ID: your organization ID
  • DETECTOR_NAME: the name of the detector you want to disable

If you activated Security Command Center at the project level, run the following:

  gcloud alpha scc settings services modules disable \
    --project=PROJECT_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=DETECTOR_NAME

Replace the following:

  • PROJECT_ID: your project ID
  • DETECTOR_NAME: the name of the detector you want to disable

Disabling detectors can impact the state of active findings. When a detector is disabled, existing findings are marked as inactive.

When you activate Security Command Center at the organization level, you can disable Security Health Analytics or specific detectors for specific folders or projects. If Security Health Analytics or detectors are turned off for folders and projects, any existing findings attached to assets in those resources are marked as inactive.

Filtering findings in the Google Cloud console

A large organization might have many vulnerability findings across their deployment to review, triage, and track. By using filters that are available on the Security Command Center Vulnerabilities and Findings pages in the Google Cloud console, you can focus on the highest severity vulnerabilities across your organization, and review vulnerabilities by asset type, project, and more.

For more information about filtering vulnerability findings, see Filter vulnerability findings in Security Command Center.

Mute findings

To control the volume of findings in Security Command Center, you can manually or programmatically mute individual findings or create mute rules that automatically mute current and future findings based on filters you define.

Muted findings are hidden and silenced, but continue to be logged for audit and compliance purposes. You can view muted findings or unmute them at any time. To learn more, see Mute findings in Security Command Center.

Marking assets and findings with security marks

You can add custom properties to findings and assets in Security Command Center by using security marks. Security marks enable you to identify high-priority areas of interest like production projects, tag findings with bug and incident tracking numbers, and more.

For assets, you can add security marks only to those assets that Security Command Center supports. For the list of supported assets, see Supported asset types in Security Command Center.

Add assets to allowlists

Although it is not a recommended method, you can suppress unneeded findings by adding dedicated security marks to assets so that the Security Health Analytics detectors don't create security findings for those assets.

The recommended and most effective approach for controlling finding volume is to Mute findings. Mute findings that you don't need to review, because they are either for assets that are isolated or because the findings fall within acceptable business parameters.

When you apply dedicated security marks to assets, the assets are added to an allowlist in Security Health Analytics, which marks any findings for those assets as resolved during the next batch scan.

Dedicated security marks must be applied directly to assets, not findings, as described in How allowlists work later on this page. If you apply a mark to a finding, the underlying asset can still generate findings.

How allowlists work

Each Security Health Analytics detector has a dedicated mark type for allowlists, in the form of allow_FINDING_TYPE:true. Adding this dedicated mark to an asset that is supported by Security Command Center lets you exclude the asset from the detection policy.

For example, to exclude the finding type SSL_NOT_ENFORCED, set the security mark, allow_ssl_not_enforced:true, on the related Cloud SQL instance. The specified detector won't create findings for marked assets.

For a complete list of finding types, see the Security Health Analytics detectors list. To learn more about security marks and techniques for using them, see Using security marks.

Asset types

This section describes how security marks work for different assets.

  • Allowlist assets: When you add a dedicated mark to an asset, like a Cloud Storage bucket or firewall, the associated finding is marked as resolved when the next batch scan runs. The detector will not generate new findings or update existing findings for the asset until the mark is removed.

  • Allowlist projects: When you add a mark to a project resource, findings for which the project itself is the scanned, or target, resource are resolved. However, assets contained within the project, such as virtual machines or crypto keys, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.

  • Allowlist folders: When you add a mark to a folder resource, findings for which the folder itself is the scanned, or target, resource are resolved. However, assets contained within the folder, including projects, can still generate findings. This security mark is only available if you activate Security Command Center Premium tier at the organization level.

  • Detectors that support multiple assets: If a detector supports more than one asset type, you must apply the dedicated mark to each asset. For instance, the detector, KMS_PUBLIC_KEY, supports two Cloud Key Management Service assets: CryptoKey and KeyRing. If you apply the mark allow_kms_public_key:true to the CryptoKey asset, KMS_PUBLIC_KEY findings for that asset are resolved but can still be generated for the KeyRing asset.

Security marks are only updated during batch scans, not real-time scans. So, if a dedicated security mark is removed, and the asset has a vulnerability, it could take up to 24 hours before the mark is deleted and a finding is written.

Special-case detector: Customer Supplied Encryption Keys

The DISK_CSEK_DISABLED detector isn't on by default. To use this detector, you must mark the assets for which you want to use self-managed encryption keys.

To enable the DISK_CSEK_DISABLED detector for specific assets, apply the security mark enforce_customer_supplied_disk_encryption_keys to the asset with a value of true.

Viewing active finding count by finding type

You can use the Google Cloud console or Google Cloud CLI commands to view active finding counts by finding type.

Console

The Google Cloud console enables you to view a count of active findings for each finding type.

To view Security Health Analytics findings by finding type, do the following:

  1. Go to Security Command Center in the Google Cloud console.

    Go to Security Command Center

  2. To display Security Health Analytics findings, click the Vulnerabilities page.

  3. To sort findings by the number of active findings for each finding type, click the Active column header.

gcloud

To use the gcloud CLI to get a count of all active findings, you query Security Command Center to get the Security Health Analytics source ID. Then you use the source ID to query the active findings count.

Step 1: Get the source ID

To complete this step, you need your organization ID. To get your organization ID, run gcloud organizations list and note the number next to the organization name.

To get the Security Health Analytics source ID, run one of the following commands, depending on whether you activated Security Command Center at the organization level or the project level:

gcloud scc sources describe organizations/ORGANIZATION_ID \
  --source-display-name='Security Health Analytics'

gcloud scc sources describe projects/PROJECT_ID \
  --source-display-name='Security Health Analytics'

If you haven't already enabled the Security Command Center API, you are prompted to enable it. When the Security Command Center API is enabled, run the previous command again. The command should display output like the following:

description: Scans for deviations from a GCP security baseline.
displayName: Security Health Analytics
name: organizations/ORGANIZATION_ID/sources/SOURCE_ID

Note the SOURCE_ID to use in the next step.

Step 2: Get the active findings count

Use the SOURCE_ID you noted in the previous step to filter findings from Security Health Analytics. The following gcloud CLI commands return a count of findings by category.

If you activated Security Command Center at the organization level, run the following:

gcloud scc findings group organizations/ORGANIZATION_ID/sources/SOURCE_ID \
 --group-by=category --page-size=PAGE_SIZE

If you activated Security Command Center at the project level, run the following:

gcloud scc findings group projects/PROJECT_ID/sources/SOURCE_ID \
 --group-by=category --page-size=PAGE_SIZE

You can set the page-size to any value up to 1000. The command should display output like the following, with results from your particular organization:

groupByResults:
- count: '1'
  properties:
    category: MFA_NOT_ENFORCED
- count: '3'
  properties:
    category: ADMIN_SERVICE_ACCOUNT
- count: '2'
  properties:
    category: API_KEY_APIS_UNRESTRICTED
- count: '1'
  properties:
    category: API_KEY_APPS_UNRESTRICTED
- count: '2'
  properties:
    category: API_KEY_EXISTS
- count: '10'
  properties:
    category: AUDIT_CONFIG_NOT_MONITORED
- count: '10'
  properties:
    category: AUDIT_LOGGING_DISABLED
- count: '1'
  properties:
    category: AUTO_UPGRADE_DISABLED
- count: '10'
  properties:
    category: BUCKET_IAM_NOT_MONITORED
- count: '10'
  properties:
    category: BUCKET_LOGGING_DISABLED
nextPageToken: TOKEN
      readTime: '2019-08-05T21:56:13.862Z'
      totalSize: 50

Programmatically manage findings

Using the Google Cloud CLI with the Security Command Center SDK enables you to automate almost anything you can do with Security Command Center in the Google Cloud console. You can also remediate many findings using the gcloud CLI. For more information, review the documentation for the resource types described in each finding:

To export or list assets programmatically, use the Cloud Asset Inventory API. For more information, see Export asset history and metadata.

The asset methods and fields of the Security Command Center API are deprecated and will be removed on or after June 26, 2024.

Until they are removed, users who activated Security Command Center before June 26, 2023 can use the asset methods of the Security Command Center API to list assets, but these methods support only the assets that Security Command Center supports.

For information about using the deprecated asset API methods, see listing assets.

Scanning projects protected by a service perimeter

This feature is only available if you activate Security Command Center Premium tier at the organization level.

If you have a service perimeter that blocks access to certain projects and services, you must grant the Security Command Center service account inbound access to that service perimeter. Otherwise, Security Health Analytics can't produce findings related to the protected projects and services.

The service account's identifier is an email address with the following format:

service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com

Replace ORGANIZATION_ID with the numerical identifier of your organization.

To grant a service account inbound access to a service perimeter, follow these steps.

  1. Go to VPC Service Controls.

    Go to VPC Service Controls

  2. On the toolbar, select your Google Cloud organization.

    Project selector

  3. In the drop-down list, select the access policy that contains the service perimeter you want to grant access to.

    Access policy list

    The service perimeters associated with the access policy appear in the list.

  4. Click the name of the service perimeter.

  5. Click Edit perimeter

  6. In the navigation menu, click Ingress Policy.

  7. Click Add rule.

  8. Configure the rule as follows:

    FROM attributes of the API client

    1. For Source, select All sources.
    2. For Identity, select Selected identities.
    3. In the Add User/Service Account field, click Select.
    4. Enter the service account email address. If you have both organization-level and project-level service accounts, add both of them.
    5. Click Save.

    TO attributes of GCP services/resources

    1. For Project, select All projects.

    2. For Services, select All services or select each of the following individual services that Security Health Analytics requires:

      • BigQuery API
      • Binary Authorization API
      • Cloud Logging API
      • Cloud Monitoring API
      • Compute Engine API
      • Kubernetes Engine API

    If a service perimeter restricts access to a required service, Security Health Analytics can't produce findings for that service.

  9. In the navigation menu, click Save.

For more information, see Configuring ingress and egress policies.

What's next