Integrate Security Command Center with Google SecOps

Integration version: 14.0

This document explains how to integrate Security Command Center with Google Security Operations.

Before you begin

Before you configure the Security Command Centerintegration in Google SecOps, complete the following prerequisite steps:

1. Create a custom Identity and Access Management role with the necessary permissions.

2. Create a service account .

3. Choose and configure one of the following authentication methods:

   • Option 1: Workload Identity (recommended): This method uses short-lived, temporary access tokens using service account impersonation, eliminating the need to store any secrets.

   • Option 2: Service account JSON key : This method relies on a static, long-lived secret key file. Use this method only if Workload Identity isn't available in your environment.

Create and configure an IAM role

To create and configure a custom role for the integration, complete the following steps:

1. In the Google Cloud console, go to IAM & Admin > Roles.

   Go to Roles

2. Click Create roleto create a custom role with permissions required for the integration.

3. Enter a Title, Description, and unique ID.

4. Set the Role Launch Stageto General Availability .

5. Add the following permissions to the created role:

   • securitycenter.assets.list
   • securitycenter.findings.list
   • securitycenter.findings.setMute
   • securitycenter.findings.setState
   • serviceusage.services.use (required for API usage and quota attribution)

6. Click Create.

Create a service account

To create a service account for the integration, complete the following steps:

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

   Go to Service Accounts

2. Click Create service account.

3. Provide a name and description and click Create and continue.

4. In the Grant this service account access to projectstep, add the custom role you created.

5. Click Doneto finish creating the account. The email address of this service account is used during the authentication configuration process.

Configure Workload Identity credentials

Choose this method or the JSON key method to authenticate the integration. Workload Identity is the recommended and more secure approach because it uses short-lived, temporary access tokens using service account impersonation, eliminating the need to store or rotate long-lived secrets.

Identify the unique instance identity

To use Workload Identity, you must grant your Google SecOps instance permission to impersonate your service account. This is the final step that allows the instance to securely access Google Cloud resources.

1. In Google SecOps, go to Content Hub > Response Integrations.

2. Select the integration you're configuring, and enter your service account email in the Workload Identity Email field.

3. Enter a valid project ID in the Quota Project ID field.

4. Click Save > Test. The test is expected to fail.

5. Click close_small to the right of Testand search the error message for the identity email beginning with gke-init-python@... or soar-python@... .

   Copy this unique email address and paste it into Workload Identity Email during integration configuration.

Authorize the instance identity in Google Cloud

Once you have retrieved the unique identity for your Google SecOps instance, you must authorize it to access your Google Cloud resources. This step enables service account impersonation, allowing the platform to generate short-lived tokens and act on your behalf without the need for static keys.

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

2. Select the target service account and navigate to Permissions > Grant Access.

3. Paste the unique email address into the New principalsfield.

4. Assign the Service Account Token Creatorrole ( roles/iam.serviceAccountTokenCreator ).

Grant quota project access

When authenticating with a Workload Identity, you must specify a Quota Project ID in the integration settings to track API usage and billing.

To authorize this, you must grant your service account the following role on the designated quota project:

1. In the Google Cloud console, go to IAM & Admin > IAMand select your project.

   Go to IAM

2. Locate your service account in the list of principals and click edit (Edit principal)for that account.

3. Click Add another roleand select Service Usage Consumer( roles/serviceusage.serviceUsageConsumer ).

4. Click Save.

Configure a JSON key

Choose this method or the Workload Identity method to authenticate the integration. Use the JSON key method only if Workload Identity isn't available in your environment, as Workload Identity is the recommended and more secure approach. This method relies on a static, long-lived secret key file that requires manual management and rotation.

Use the following procedure to generate the JSON key file required to authenticate the integration:

1. In the Google Cloud console, go to IAM & Admin > Service Accountsand select the service account you created.

   Go to Service Accounts

2. Go to the Keystab.

3. Click Add key > Create new key.

4. Select JSON as the key type and click Create. The JSON file downloads to your computer.

5. Copy the entire content of this file and paste it into User's service account during integration configuration.

Integration parameters

The Security Command Centerintegration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

Get Finding Details

Use the Get Finding Detailsaction to retrieve details about a finding in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Finding Detailsaction requires the following parameters:

Action outputs

The Get Finding Detailsaction provides the following outputs:

Case wall table

The Get Finding Detailsaction can return the following table:

Table title: Finding Details

Table columns:

• Category
• State
• Severity
• Type

JSON result

The following example shows the JSON result output received when using the Get Finding Detailsaction:

  { 
  
 { 
  
 "finding_name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m" 
 , 
  
 "finding" 
 : 
  
 { 
  
 "name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m" 
 , 
  
 "parent" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869" 
 , 
  
 "resourceName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "state" 
 : 
  
 "ACTIVE" 
 , 
  
 "category" 
 : 
  
 "Discovery: Service Account Self-Investigation" 
 , 
  
 "sourceProperties" 
 : 
  
 { 
  
 "sourceId" 
 : 
  
 { 
  
 "projectNumber" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "customerOrganizationNumber" 
 : 
  
 " ORGANIZATION_ID 
" 
  
 }, 
  
 "detectionCategory" 
 : 
  
 { 
  
 "technique" 
 : 
  
 "discovery" 
 , 
  
 "indicator" 
 : 
  
 "audit_log" 
 , 
  
 "ruleName" 
 : 
  
 "iam_anomalous_behavior" 
 , 
  
 "subRuleName" 
 : 
  
 "service_account_gets_own_iam_policy" 
  
 }, 
  
 "detectionPriority" 
 : 
  
 "LOW" 
 , 
  
 "affectedResources" 
 : 
  
 [ 
  
 { 
  
 "gcpResourceName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
  
 } 
  
 ], 
  
 "evidence" 
 : 
  
 [ 
  
 { 
  
 "sourceLogId" 
 : 
  
 { 
  
 "projectId" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "resourceContainer" 
 : 
  
 "projects/ PROJECT_ID 
" 
 , 
  
 "timestamp" 
 : 
  
 { 
  
 "seconds" 
 : 
  
 "1622678907" 
 , 
  
 "nanos" 
 : 
  
 448368000 
  
 }, 
  
 "insertId" 
 : 
  
 " ID 
" 
  
 } 
  
 } 
  
 ], 
  
 "properties" 
 : 
  
 { 
  
 "serviceAccountGetsOwnIamPolicy" 
 : 
  
 { 
  
 "principalEmail" 
 : 
  
 "prisma-cloud-serv@ PROJECT_ID 
.iam.gserviceaccount.com" 
 , 
  
 "projectId" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "callerIp" 
 : 
  
 "192.0.2.41" 
 , 
  
 "callerUserAgent" 
 : 
  
 "Redlock/GC-MDC/resource-manager/ PROJECT_ID 
Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)" 
 , 
  
 "rawUserAgent" 
 : 
  
 "Redlock/GC-MDC/resource-manager/ PROJECT_ID 
Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)" 
  
 } 
  
 }, 
  
 "contextUris" 
 : 
  
 { 
  
 "mitreUri" 
 : 
  
 { 
  
 "displayName" 
 : 
  
 "Permission Groups Discovery: Cloud Groups" 
 , 
  
 "url" 
 : 
  
 "https://attack.mitre.org/techniques/ ID 
/003/" 
  
 }, 
  
 "cloudLoggingQueryUri" 
 : 
  
 [ 
  
 { 
  
 "displayName" 
 : 
  
 "Cloud Logging Query Link" 
 , 
  
 "url" 
 : 
  
 "https://console.cloud.google.com/logs/query;query=timestamp%3D%222021-06-03T00:08:27.448368Z%22%0AinsertId%3D%22 ID 
%22%0Aresource.labels.project_id%3D%22 PROJECT_ID 
%22?project= PROJECT_ID 
" 
  
 } 
  
 ] 
  
 } 
  
 }, 
  
 "securityMarks" 
 : 
  
 { 
  
 "name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/ SOURCE_ID 
/findings/ FINDING_ID 
/securityMarks" 
  
 }, 
  
 "eventTime" 
 : 
  
 "2021-06-03T00:08:27.448Z" 
 , 
  
 "createTime" 
 : 
  
 "2021-06-03T00:08:31.074Z" 
 , 
  
 "severity" 
 : 
  
 "LOW" 
 , 
  
 "canonicalName" 
 : 
  
 "projects/ PROJECT_ID 
/sources/ SOURCE_ID 
/findings/ FINDING_ID 
" 
 , 
  
 "mute" 
 : 
  
 "UNDEFINED" 
 , 
  
 "findingClass" 
 : 
  
 "THREAT" 
 , 
  
 "mitreAttack" 
 : 
  
 { 
  
 "primaryTactic" 
 : 
  
 "DISCOVERY" 
 , 
  
 "primaryTechniques" 
 : 
  
 [ 
  
 "PERMISSION_GROUPS_DISCOVERY" 
 , 
  
 "CLOUD_GROUPS" 
  
 ] 
  
 } 
  
 }, 
  
 "resource" 
 : 
  
 { 
  
 "name" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "projectName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "projectDisplayName" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "parentName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/organizations/ ORGANIZATION_ID 
" 
 , 
  
 "parentDisplayName" 
 : 
  
 "example.net" 
 , 
  
 "type" 
 : 
  
 "google.cloud.resourcemanager.Project" 
 , 
  
 "displayName" 
 : 
  
 " PROJECT_ID 
" 
  
 } 
  
 } 
 } 
 

Output messages

The Get Finding Detailsaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Finding Detailsaction:

List Asset Vulnerabilities

Use the List Asset Vulnerabilitiesaction to list vulnerabilities related to entities in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The List Asset Vulnerabilitiesaction requires the following parameters:

Action outputs

The List Asset Vulnerabilitiesaction provides the following outputs:

Case wall table

The List Asset Vulnerabilitiesaction can return the following tables:

Table title: ASSET_ID Vulnerabilities

Table columns:

• Category
• Description
• Severity
• Event Time
• CVE

Table title: ASSET_ID Misconfigurations

Table columns:

• Category
• Description
• Severity
• Event Time
• Recommendation

JSON result

The following example shows the JSON result output received when using the List Asset Vulnerabilitiesaction:

  { 
  
 . 
 "siemplify_asset_display_name" 
 :[ 
 1 
 ] 
  
 [ 
 2 
 ] 
  
 "" 
 "vulnerabilities" 
 : 
  
 { 
  
 "statistics" 
 : 
  
 { 
  
 "critical" 
 : 
  
 1 
 , 
  
 "high" 
 : 
  
 1 
 , 
  
 "medium" 
 : 
  
 1 
 , 
  
 "low" 
 : 
  
 1 
 , 
  
 "undefined" 
 : 
  
 1 
  
 }, 
  
 "data" 
 : 
  
 [ 
  
 { 
  
 "category" 
 : 
  
 " CATEGORY 
" 
  
 "description" 
 : 
  
 " DESCRIPTION 
" 
  
 "cve_id" 
 : 
  
 " CVE_ID 
" 
  
 "event_time" 
 : 
  
 " EVENT_TIME 
" 
  
 "related_references" 
 : 
  
 " RELATED_REFERENCES 
" 
  
 "severity" 
 : 
  
 " SEVERITY 
" 
  
 } 
  
 ] 
  
 }, 
  
 "misconfigurations" 
 : 
  
 { 
  
 "statistics" 
 : 
  
 { 
  
 "critical" 
 : 
  
 1 
 , 
  
 "high" 
 : 
  
 1 
 , 
  
 "medium" 
 : 
  
 1 
 , 
  
 "low" 
 : 
  
 1 
 , 
  
 "undefined" 
 : 
  
 1 
  
 }, 
  
 "data" 
 : 
  
 [ 
  
 { 
  
 "category" 
 : 
  
 " CATEGORY 
" 
  
 "description" 
 : 
  
 " DESCRIPTION 
" 
  
 "recommendation" 
 : 
  
 " RECOMMENDATION 
" 
  
 "event_time" 
 : 
  
 " EVENT_TIME 
" 
  
 "severity" 
 : 
  
 " SEVERITY 
" 
  
 } 
  
 ] 
  
 }, 
 } 
 

Output messages

The List Asset Vulnerabilitiesaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Asset Vulnerabilitiesaction:

Ping

Use the Pingaction to test the connectivity to Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Update Finding

Use the Update Findingaction to update an existing finding in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The Update Findingaction requires the following parameters:

Action outputs

The Update Findingaction provides the following outputs:

Output messages

The Update Findingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update Findingaction:

Connectors

To learn more about configuring connectors in Google SecOps, see Ingest your data (connectors) .

For example, a single raw alert containing three different email addresses is ingested as three separate events, each containing one distinct email address.

This process ensures that every entity is correctly indexed as a unique asset, making it fully searchable and actionable in playbooks.

Security Command Center - Findings Connector

Use the Security Command Center - Findings Connectorto retrieve information about findings from Security Command Center.

This connector supports filtering findings by category using the dynamic list.

Connector inputs

The Security Command Center - Findings Connectorrequires the following parameters:

Need more help? Get answers from Community members and Google SecOps professionals.