Integrate Security Command Center with Google SecOps

Integration version: 14.0

This document explains how to integrate Security Command Center with Google Security Operations.

Before you begin

To integrate Security Command Center, you must complete the following steps:

1. Create a custom Identity and Access Management (IAM) role with the necessary permissions.

2. Configure authentication using one of the following options:

   • JSON key

   • Workload Identity (Recommended)

Create and configure an IAM role

To create and configure a custom IAM role for the integration, complete the following steps:

1. In the Google Cloud console, go to the IAM Rolespage.

   Go to Roles

2. Click Create roleto create a custom role with permissions required for the integration.

3. Enter a Title, Description, and unique ID.

4. Set the Role Launch Stageto General Availability .

5. Add the following permissions to the created role:

   • securitycenter.assets.list

   • securitycenter.findings.list

   • securitycenter.findings.setMute

   • securitycenter.findings.setState

6. Click Create.

Configure authentication

To authenticate the integration, use a service account with a JSON key, or with a Workload Identity.

Authentication with a JSON key

This method uses a static JSON key file to authenticate the service account.

Create a service account

To authenticate using a JSON key, you must first create a service account:

1. In the Google Cloud console, navigate to IAM & Admin > Service accounts.

2. Select the project where you want to create the service account.

3. Click Create Service Account.

   If you prefer to use an existing service account, select the service account you want to use and generate a JSON key .

4. Provide a name and description and click Create and Continue.

5. In the Grant this service account access to projectstep, add the custom role you created.

6. Click Doneto finish creating the account.

Generate a JSON Key

Complete the following steps to generate the required JSON key file:

1. In the service accounts list, select the email address of the service account you created (or selected) to open its details.

2. Click the Keystab.

3. Click Add Key > Create new key.

4. Select JSONas the key type and click Create.

5. The JSON key file downloads to your computer. Store this file securely and paste the entire contents of this file into User's Service Account when configuring the integration parameters.

Authentication with a Workload Identity (Recommended)

This method allows the integration to impersonate a service account without the need to handle long-lived secrets.

To configure a Workload Identity, complete the following steps:

1. In the Google Cloud console, go to IAM & Admin > Service accounts.

2. Select an existing service account or create a new one.

3. Grant the custom role you created to the service account.

4. Grant the Service Usage Consumerrole to the service account. This permission is required to associate API usage with the project defined in the Quota Project ID .

5. Grant the Service Account Token Creatorrole to the service account.

   This permission allows the integration to generate the short-lived credentials needed for authentication.

6. Note the Client Emailof the service account and use this value in Workload Identity Emailwhen configuring the integration parameters.

Integration parameters

The Security Command Centerintegration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

Get Finding Details

Use the Get Finding Detailsaction to retrieve details about a finding in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Finding Detailsaction requires the following parameters:

Action outputs

The Get Finding Detailsaction provides the following outputs:

Case wall table

The Get Finding Detailsaction can return the following table:

Table title: Finding Details

Table columns:

• Category
• State
• Severity
• Type

JSON result

The following example shows the JSON result output received when using the Get Finding Detailsaction:

  { 
  
 { 
  
 "finding_name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m" 
 , 
  
 "finding" 
 : 
  
 { 
  
 "name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869/findings/hvX6WwbvFyBGqPbEs9WH9m" 
 , 
  
 "parent" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/2678067631293752869" 
 , 
  
 "resourceName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "state" 
 : 
  
 "ACTIVE" 
 , 
  
 "category" 
 : 
  
 "Discovery: Service Account Self-Investigation" 
 , 
  
 "sourceProperties" 
 : 
  
 { 
  
 "sourceId" 
 : 
  
 { 
  
 "projectNumber" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "customerOrganizationNumber" 
 : 
  
 " ORGANIZATION_ID 
" 
  
 }, 
  
 "detectionCategory" 
 : 
  
 { 
  
 "technique" 
 : 
  
 "discovery" 
 , 
  
 "indicator" 
 : 
  
 "audit_log" 
 , 
  
 "ruleName" 
 : 
  
 "iam_anomalous_behavior" 
 , 
  
 "subRuleName" 
 : 
  
 "service_account_gets_own_iam_policy" 
  
 }, 
  
 "detectionPriority" 
 : 
  
 "LOW" 
 , 
  
 "affectedResources" 
 : 
  
 [ 
  
 { 
  
 "gcpResourceName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
  
 } 
  
 ], 
  
 "evidence" 
 : 
  
 [ 
  
 { 
  
 "sourceLogId" 
 : 
  
 { 
  
 "projectId" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "resourceContainer" 
 : 
  
 "projects/ PROJECT_ID 
" 
 , 
  
 "timestamp" 
 : 
  
 { 
  
 "seconds" 
 : 
  
 "1622678907" 
 , 
  
 "nanos" 
 : 
  
 448368000 
  
 }, 
  
 "insertId" 
 : 
  
 " ID 
" 
  
 } 
  
 } 
  
 ], 
  
 "properties" 
 : 
  
 { 
  
 "serviceAccountGetsOwnIamPolicy" 
 : 
  
 { 
  
 "principalEmail" 
 : 
  
 "prisma-cloud-serv@ PROJECT_ID 
.iam.gserviceaccount.com" 
 , 
  
 "projectId" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "callerIp" 
 : 
  
 "192.0.2.41" 
 , 
  
 "callerUserAgent" 
 : 
  
 "Redlock/GC-MDC/resource-manager/ PROJECT_ID 
Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)" 
 , 
  
 "rawUserAgent" 
 : 
  
 "Redlock/GC-MDC/resource-manager/ PROJECT_ID 
Google-API-Java-Client HTTP-Java-Client/1.34.0 (gzip),gzip(gfe)" 
  
 } 
  
 }, 
  
 "contextUris" 
 : 
  
 { 
  
 "mitreUri" 
 : 
  
 { 
  
 "displayName" 
 : 
  
 "Permission Groups Discovery: Cloud Groups" 
 , 
  
 "url" 
 : 
  
 "https://attack.mitre.org/techniques/ ID 
/003/" 
  
 }, 
  
 "cloudLoggingQueryUri" 
 : 
  
 [ 
  
 { 
  
 "displayName" 
 : 
  
 "Cloud Logging Query Link" 
 , 
  
 "url" 
 : 
  
 "https://console.cloud.google.com/logs/query;query=timestamp%3D%222021-06-03T00:08:27.448368Z%22%0AinsertId%3D%22 ID 
%22%0Aresource.labels.project_id%3D%22 PROJECT_ID 
%22?project= PROJECT_ID 
" 
  
 } 
  
 ] 
  
 } 
  
 }, 
  
 "securityMarks" 
 : 
  
 { 
  
 "name" 
 : 
  
 "organizations/ ORGANIZATION_ID 
/sources/ SOURCE_ID 
/findings/ FINDING_ID 
/securityMarks" 
  
 }, 
  
 "eventTime" 
 : 
  
 "2021-06-03T00:08:27.448Z" 
 , 
  
 "createTime" 
 : 
  
 "2021-06-03T00:08:31.074Z" 
 , 
  
 "severity" 
 : 
  
 "LOW" 
 , 
  
 "canonicalName" 
 : 
  
 "projects/ PROJECT_ID 
/sources/ SOURCE_ID 
/findings/ FINDING_ID 
" 
 , 
  
 "mute" 
 : 
  
 "UNDEFINED" 
 , 
  
 "findingClass" 
 : 
  
 "THREAT" 
 , 
  
 "mitreAttack" 
 : 
  
 { 
  
 "primaryTactic" 
 : 
  
 "DISCOVERY" 
 , 
  
 "primaryTechniques" 
 : 
  
 [ 
  
 "PERMISSION_GROUPS_DISCOVERY" 
 , 
  
 "CLOUD_GROUPS" 
  
 ] 
  
 } 
  
 }, 
  
 "resource" 
 : 
  
 { 
  
 "name" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "projectName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/projects/ PROJECT_ID 
" 
 , 
  
 "projectDisplayName" 
 : 
  
 " PROJECT_ID 
" 
 , 
  
 "parentName" 
 : 
  
 "//cloudresourcemanager.googleapis.com/organizations/ ORGANIZATION_ID 
" 
 , 
  
 "parentDisplayName" 
 : 
  
 "example.net" 
 , 
  
 "type" 
 : 
  
 "google.cloud.resourcemanager.Project" 
 , 
  
 "displayName" 
 : 
  
 " PROJECT_ID 
" 
  
 } 
  
 } 
 } 
 

Output messages

The Get Finding Detailsaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Finding Detailsaction:

List Asset Vulnerabilities

Use the List Asset Vulnerabilitiesaction to list vulnerabilities related to entities in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The List Asset Vulnerabilitiesaction requires the following parameters:

Action outputs

The List Asset Vulnerabilitiesaction provides the following outputs:

Case wall table

The List Asset Vulnerabilitiesaction can return the following tables:

Table title: ASSET_ID Vulnerabilities

Table columns:

• Category
• Description
• Severity
• Event Time
• CVE

Table title: ASSET_ID Misconfigurations

Table columns:

• Category
• Description
• Severity
• Event Time
• Recommendation

JSON result

The following example shows the JSON result output received when using the List Asset Vulnerabilitiesaction:

  { 
  
 . 
 "siemplify_asset_display_name" 
 :[ 
 1 
 ] 
  
 [ 
 2 
 ] 
  
 "" 
 "vulnerabilities" 
 : 
  
 { 
  
 "statistics" 
 : 
  
 { 
  
 "critical" 
 : 
  
 1 
 , 
  
 "high" 
 : 
  
 1 
 , 
  
 "medium" 
 : 
  
 1 
 , 
  
 "low" 
 : 
  
 1 
 , 
  
 "undefined" 
 : 
  
 1 
  
 }, 
  
 "data" 
 : 
  
 [ 
  
 { 
  
 "category" 
 : 
  
 " CATEGORY 
" 
  
 "description" 
 : 
  
 " DESCRIPTION 
" 
  
 "cve_id" 
 : 
  
 " CVE_ID 
" 
  
 "event_time" 
 : 
  
 " EVENT_TIME 
" 
  
 "related_references" 
 : 
  
 " RELATED_REFERENCES 
" 
  
 "severity" 
 : 
  
 " SEVERITY 
" 
  
 } 
  
 ] 
  
 }, 
  
 "misconfigurations" 
 : 
  
 { 
  
 "statistics" 
 : 
  
 { 
  
 "critical" 
 : 
  
 1 
 , 
  
 "high" 
 : 
  
 1 
 , 
  
 "medium" 
 : 
  
 1 
 , 
  
 "low" 
 : 
  
 1 
 , 
  
 "undefined" 
 : 
  
 1 
  
 }, 
  
 "data" 
 : 
  
 [ 
  
 { 
  
 "category" 
 : 
  
 " CATEGORY 
" 
  
 "description" 
 : 
  
 " DESCRIPTION 
" 
  
 "recommendation" 
 : 
  
 " RECOMMENDATION 
" 
  
 "event_time" 
 : 
  
 " EVENT_TIME 
" 
  
 "severity" 
 : 
  
 " SEVERITY 
" 
  
 } 
  
 ] 
  
 }, 
 } 
 

Output messages

The List Asset Vulnerabilitiesaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Asset Vulnerabilitiesaction:

Ping

Use the Pingaction to test the connectivity to Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Update Finding

Use the Update Findingaction to update an existing finding in Security Command Center.

This action doesn't run on Google SecOps entities.

Action inputs

The Update Findingaction requires the following parameters:

Action outputs

The Update Findingaction provides the following outputs:

Output messages

The Update Findingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update Findingaction:

Connectors

To learn more about configuring connectors in Google SecOps, see Ingest your data (connectors) .

For example, a single raw alert containing three different email addresses is ingested as three separate events, each containing one distinct email address.

This process ensures that every entity is correctly indexed as a unique asset, making it fully searchable and actionable in playbooks.

Security Command Center - Findings Connector

Use the Security Command Center - Findings Connectorto retrieve information about findings from Security Command Center.

This connector supports filtering findings by category using the dynamic list.

Connector inputs

The Security Command Center - Findings Connectorrequires the following parameters:

Need more help? Get answers from Community members and Google SecOps professionals.