Security Command Center

Google Cloud is taking a massive leap forward in cloud security by integrating Mandiant's Attack Surface Management (ASM) capabilities into the Enterprise Tier of its Security Command Center (SCC). Let's explore what this means for anyone seeking to fortify their cloud environments. What is Mandiant Attack Surface Management? Mandiant Attack Surface Management is a cybersecurity solution that continuously discovers, analyzes, and prioritizes an organization's internet-facing vulnerabilities from the attacker's point of view, helping to reduce the risk of breaches. Think of it as your digital perimeter's vigilant watchdog: Continuous Discovery: It relentlessly scans your entire Cloud Asset Inventory. Exposure Quantification: ASM goes beyond simple identification. It analyzes and prioritizes discovered vulne

Hello Google Support Team,I am the owner and developer of the website: https://www.bawoumarket.com (and the hosting URL: [suspicious link removed]).I recently deployed this website using Firebase Hosting. It is a legitimate e-commerce project currently under development. I added a login.html page for user authentication, and immediately after deployment, Google Chrome started flagging my site as "Dangerous / Deceptive Site Ahead".This is a false positive. The site is clean, safe, and does not contain any phishing or malicious content. It is simply a new project with a login form.I have verified my ownership in Google Search Console.Please review the site and remove the red warning screen so I can continue my developme

Why Daily Status Report is not available ?

Hello Guys, I am able to see many container image vulnerabilities in our environment. The occurrences are from artifact registry.We have fixed from 156 vulnerabilities to 22 and deleted the older digests as well.But in Risk overview -> Findings -> I am still able to see the older digests vulnerabilities that have already been fixed. When I click them it shows not found (That confirms it was deleted) but in findings tab it still retains the count.Why doesn't the count gets refreshed? We have tried manual artifact image scanning using Gcloud artifact scanner and also tried pushing the image again for refreshing still its not working. Any solution ?

Google Cloud's Security Command Center (SCC) offers a unified dashboard for consolidating security findings and assets. But what if you need to add your own business context to these findings? That's where security marks come in. To incorporate your specific business context into these findings, security marks prove invaluable. With the recent GUI upgrade, Enterprise versions now necessitate API usage, while SCC Standard and Premium versions retain GUI functionality. Security marks are custom key-value pairs you can use to annotate assets and findings in SCC. They allow you to add context like:Priority: “priority: high” Access Level: “access: confidential” Application: “app: marketing-web-prod” Incident Reference: “Incident-number: x2345”This feature is incredibly powerful for filtering, managing policies, and integrating SCC data into your security w

Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task. To help lighten the load, Google Cloud is rolling out the new feature - SCC Compliance Manager, currently in preview for Enterprise Tier.Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available.So, what can it do for you?Define and deploy security rules: Instead of manually setting up security policies across your environment, Compliance Manager helps you define and deploy a secure and compliant configuration from the get-go.

 Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task.To help lighten the load, Google Cloud is rolling out the new features in SCC Compliance Manager, currently in preview (For Enterprise service Tier). Compliance Manager in Google Cloud enables organizations to meet security and regulatory requirements for their Google Cloud infrastructure, workloads, and data. Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available. So, what can it do for you?Define and deploy security r

I'm trying to setup up Web Security Scanner with non-Google account for authorisation. I have a simplified login form that works as expected when saving the scan details, and I can see in our server login it's requesting the page, submitting the form, receiving the cookie, and then viewing the post-login page successfully.However when I try to run the scan it is always return a Login procedure failed error. Checking the logs I can see it's still visiting the sign in page, however no POST requests are being made. This includes both the post for the submit form, and another POST request that runs on page load. Both are called when the scan settings are being saved and verified however.I can see the login form submit is definitely triggering. From reading the documentation I can see custom scans should support POST requests, on managed scans are GET only. We are using the standard tier so these scans can only be custom scans.I've testing using alternate U

  Security Marks are a unique concept in Security Command Center.  They allow us to annotate assets or findings in SCC with additional business context.  You can apply Security Marks to both Assets and Findings. To apply Security Marks, you'll need one or both of the following permissions depending on whether you'll be applying Security Marks to assets, to findings, or both. For Asset Security Marks: Asset Security Marks Writer, securitycenter.assetSecurityMarksWriter For Finding Security Marks: Finding Security Marks Writer, securitycenter.findingSecurityMarksWriter You can add a Security Mark to an asset by navigating to the Assets view in Security Command Center and then selecting one or more assets.  Click the Set Security Marks button.

Hello Security Engineers\\Operators\\AnalystsGoogle Cloud Learning Services has launched a new lab for Model Armor.  This lab will cover the basics of getting started with Model Armor and walks you through initial steps for working with the product. Get used to configuration and responses from within the product set while learning how you might implement it for your own applications or agents. Find our new lab at the link below. Sanitize Prompts and Responses with Model Armor  Do you want to know more details? Model Armor on Google Cloud Platform enhances AI safety by screening both user prompts and LLM responses for risks like harmful content, prompt injection, and sensitive data leaks. It allows organizations to centrally m

Please note at the time of this post the Toxic Combinations feature is currently in Preview. A toxic combination is a group of security issues that, when they occur together in a particular pattern, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources. A security issue is anything that contributes to the exposure of your cloud resources, such as a particular configuration of resources, a misconfiguration, or a software vulnerability. The Risk Engine of Security Command Center Enterprise detects toxic combinations during the attack path simulations it runs. For each toxic combination that Risk Engine detects, it issues a finding. Each finding includes an a

How does it work? Hash Generation: The system generates hashes for process binary data. VirusTotal (VT) Query: Hashes are used to construct VT links and query the VT database. Link Retrieval: VT link is retrieved and displayed alongside corresponding findings. Risk Assessment: Quickly assess risk based on VT reputation data (e.g., benign, suspicious, malicious). Does customers need a VirusTotal License?VirusTotal License are not required to leve

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.What it does? Create and scan short-lived snapshots of Linux-and Windows-based Virtual Machines for malware without disrupting the workloads.  Analyzes executables on the VM for known malware signatures. Detected findings are reported to Google SCC. Enabling VM

On June 4, we posted a blog highlighting new features in Security Command Center (SCC) and Security Command Center Enterprise (SCCE). One of the cool new features available to customers is an integration with the Artifact Analysis component of Artifact Registry.  To learn more about this new integration as well as other new developments like agentless scanning for Google Cloud Compute and Google Kubernetes Engine (GKE), check out the below link to the full blog! https://cloud.google.com/blog/products/identity-security/enhancing-protection-4-new-security-command-center-capabilities

Hello,We are looking for the process to integrate SecOps with PagerDuty. Is there any process documentation available.Thanks

Has anyone implemented Security Command Center Enterprise? Do you know the billing model?

Trying to install an extension I get a message saying something like my admin  policy won't allow the installation. I've been trying to do something about this for some time to no avail. If this is the wrong place to ask this question I apologize.

I have been trying to create a new Scan with "Non-Google account" authentication for a while and always fails with a FAILED_TO_AUTHENTICATE_TO_TARGET error code.According to the documentation, the possible issues could be:Using non-standard HTML form fields, for example, not using a password type.Using a complicated login form, for example, a form that has more than a single username and password field.Not saving an authentication cookie on successful login.In some situations, the scanner is denied by counter-measures that are meant to protect against bots, DDOS, and other attacks.I can confirm that a simple form is being used, it has no more that a single usernam

Hi Folks!,Can anyone clarify what the logs from abuseevent.googleapis.com in GCP represent?The name gives some indication, but I'd like to know how to enable them.Is there any documentation available that explains this in detail?

What’s New in Security Command Center? This Seurity Command Center product release digest is designed to keep you informed about the latest advancements in SCC Enterprise and SCC Premium. Discover the latest cloud security capabilities that we made available in Q3 2024.__________________________________________________________________________________ Get expanded CIEM support for additional clouds and identity providers (Generally Available)   Security Command Center now supports AWS IAM identities for AWS, and Entra ID (Azure AD) and Okta identities on Google Cloud. With multicloud, multi-identity CIEM support, it’s easier to discover which identities have access to which cloud reso

In this brief post, I'll show you how to view the list of Continuous Exports that have been defined in Security Command Center.   Continuous Exports allow SCC to send Findings that match a given query to some external destination, like a Pub/Sub topic.  In some cases, you might want to view the existing configuration for Continuous Exports that have been defined, like for the purpose of verifying what the associated query consists of. In SCC, you can access the list of existing continuous exports by navigating to Risk Overview >  Settings, and then clicking the Continuous Exports tab.   In the subsequent screen, you'll see a list of configurations associated with each Continuous Export defined in SCC.

Hi,I am facing issue with Security Command Center(RiskOverview) page and given detailed steps as below.I have permissions for Security Command Center(SCC) with "Enterprise" at Organization level and  "Premium" at Project level. But I could not be able to see any information in "RiskOver" page for  "Top CVE findings on your virtual machines". I have gone through various SCC documentations and changed IAM permissions for my account to see the information for  "Top CVE findings on your virtual machines".After trying a lot of ways, I came to here for a solution. Please suggest how to proceed further and if any other information is required from myside, please let me know. I will provide the r

Hi experts, I am trying to understand the items list on the Vulneraibilities of SCC. There are a lot of items that have no Module ID in the Vulneraibilities page. For example, Cataegory: GKE Security bulletin, Secrets in environment variables, block all ingress. Is there any documents about these items without Module id?Many thanks. BR,Lee 

Hi Recently one of my clients said  that they r planning to migrate from premium to enterprise edition and requested us to onboard it in SOAR. I have couple of questions, not sure if this is the right place1) in terms of integrating  with SOAR , is there going to be any changes , we have sccp currently fed to secops soar. Does it require new integration. 2) in terms of playbooks that exists for sccp , do we need to also make changes in that. 3) would there be new findings which were not previously seen in sccp.