Publish data profiles to Security Command Center

This page provides a high-level overview of the actions that you must take if you want data profiles to generate findings in Security Command Center . This page also provides example queries that you can use to find the generated findings.

About data profiles

You can configure Sensitive Data Protection to automatically generate profiles about data across an organization, folder, or project. Data profiles contain metrics and metadata about your data and help you determine where sensitive and high-risk data reside. Sensitive Data Protection reports these metrics at various levels of detail. For information about the types of data you can profile, see Supported resources .

Benefits of publishing data profiles to Security Command Center

This feature offers the following benefits in Security Command Center:

• You can use Sensitive Data Protection findings to identify and remediate vulnerabilities and misconfigurations in your resources that can expose sensitive data to the public or to malicious actors.

• You can use Sensitive Data Protection findings to add context to the triage process and prioritize threats that target resources containing sensitive data.

• You can configure the attack path simulation feature to automatically prioritize resources according to the sensitivity of the data that the resources contain. For more information, see Set resource priority values automatically by data sensitivity .

Generated Security Command Center findings

When you configure the discovery service to publish data profiles to Security Command Center, each table data profile or file store data profile generates the following Security Command Center findings.

Vulnerability findings from the discovery service

The Sensitive Data Protection discovery service helps you determine whether you are storing highly sensitive data that is not protected.

Misconfiguration findings from the discovery service

The Sensitive Data Protection discovery service helps you determine whether you have misconfigurations that might expose sensitive data.

Observation findings from the discovery service

Data sensitivity

An indication of the sensitivity level of the data in a particular data asset. Data is sensitive if it contains PII or other elements that might require additional control or management. The severity of the finding is the sensitivity level that Sensitive Data Protection calculated when generating the data profile.

Data risk

The risk associated with the data in its current state. When calculating data risk, Sensitive Data Protection considers the sensitivity level of the data in the data asset and the presence of access controls to protect that data. The severity of the finding is the data risk level that Sensitive Data Protection calculated when generating the data profile.

Finding generation latency

Depending on the size of your organization, Sensitive Data Protection findings can start appearing in Security Command Center within a few minutes after you enable sensitive data discovery. For larger organizations or organizations with specific configurations that affect finding generation, it can take up to 12 hours before initial findings appear in Security Command Center.

Subsequently, Sensitive Data Protection generates findings in Security Command Center within a few minutes after the discovery service scans your resources.

Send data profiles to Security Command Center

The following is a high-level workflow for publishing data profiles to Security Command Center.

1. Check the activation type of Security Command Center . You might have a default organization-level discovery subscription, depending on your Security Command Center service tier .

2. If Security Command Center isn't activated, then activate it .

3. Confirm that Security Command Center is configured to accept findings from Sensitive Data Protection; that is, Sensitive Data Protectionis enabled in Security Command Center as an integrated service. For more information, see Add a Google Cloud integrated service in the Security Command Center documentation.

4. Enable discovery by creating a discovery scan configuration for each data source that you want to scan. In your scan configuration, make sure that you keep the Publish to Security Command Centeroption enabled.

   If you have an existing discovery scan configuration that doesn't publish data profiles to Security Command Center, see Enable publishing to Security Command Center in an existing configuration on this page.

Enable discovery with default settings in an organization

To enable discovery, you create a discovery configuration for each data source that you want to scan. You can edit the configurations after creating them. To customize settings in the process of creating a configuration, see Create a scan configuration instead.

To enable discovery with default settings at the organization level, follow these steps:

1. In the Google Cloud console, go to the Sensitive Data Protection Enable discoverypage.

   Go to Enable discovery

2. Verify that you are viewing the organization that you activated Security Command Center on.

3. In the Enable discoverypane, in the Service agent containerfield, set the project to be used as a service agent container . Within this project, the system creates a service agent and automatically grants the required discovery roles to it.

   • To automatically create a project to use as your service agent container, follow these steps:

     1. Click Create.
     2. Specify the name, billing account, and parent organization of the new project. Optionally, edit the project ID.
     3. Click Create.

     It can take a few minutes for the roles to be granted to the new project's service agent.

   • To select a project that you previously used for discovery operations, click the Service agent containerfield and select the project.

4. To review the default settings, click the expand_more expand icon.

5. In the Enable discoverysection, for each discovery type that you want to enable, click Enable. Enabling a discovery type does the following:

   • BigQuery: Creates a discovery configuration for profiling BigQuery tables across the organization. Sensitive Data Protection starts profiling your BigQuery data and sends the profiles to Security Command Center.
   • Cloud SQL: Creates a discovery configuration for profiling Cloud SQL tables across the organization. Sensitive Data Protection starts creating default connections for each of your Cloud SQL instances. This process can take a few hours. When the default connections are ready, you must give Sensitive Data Protection access to your Cloud SQL instances by updating each connection with the proper database user credentials.
   • Secrets/credentials vulnerabilities: Creates a discovery configuration for detecting and reporting unencrypted secrets in Cloud Run environment variables. Sensitive Data Protection starts scanning your environment variables.
   • Cloud Storage: Creates a discovery configuration for profiling Cloud Storage buckets across the organization. Sensitive Data Protection starts profiling your Cloud Storage data and sends the profiles to Security Command Center.
   • Vertex AI datasets: Creates a discovery configuration for profiling Vertex AI datasets across the organization. Sensitive Data Protection starts profiling your Vertex AI datasets and sends the profiles to Security Command Center.

   • Amazon S3: Creates a discovery configuration for profiling all Amazon S3 data that your AWS connector has access to.

   • Azure Blob Storage: Creates a discovery configuration for profiling all Azure Blob Storage data that your Azure connector has access to.

6. To view the newly created discovery configurations, click Go to discovery configuration.

   If you enabled Cloud SQL discovery, the discovery configuration is created in paused mode with errors indicating the absence of credentials. See Manage connections for use with discovery to grant the required IAM roles to your service agent and to provide database user credentials for each Cloud SQL instance.

7. Close the pane.

Enable publishing to Security Command Center in an existing configuration

If you have an existing discovery scan configuration that is not set to publish discovery results to Security Command Center, follow these steps:

1. Open the scan configuration for editing .

2. In the Actionssection, enable Publish to Security Command Center.

3. Click Save.

Query for Security Command Center findings related to data profiles

The following are example queries that you can use to find relevant Data sensitivity and Data risk findings in Security Command Center. You can enter these queries in the Query editorfield. For more information about the query editor, see Edit a findings query in the Security Command Center dashboard .

List all Data sensitivity and Data risk findings for a particular BigQuery table

This query is useful, for example, if Security Command Center detects an event where a BigQuery table was saved to a different project. In this case, an Exfiltration: BigQuery Data Exfiltration finding is generated, and it contains the full display name of the table that was exfiltrated. You can search for any Data sensitivity and Data risk findings related to the table. View the calculated sensitivity and data risk levels for the table and plan your response accordingly.

  state 
 = 
 "ACTIVE" 
 AND 
  
 NOT 
  
 mute 
 = 
 "MUTED" 
 AND 
  
 category 
 = 
 "DATA_RISK" 
  
 OR 
  
 category 
 = 
 "DATA_SENSITIVITY" 
 AND 
  
 resource 
 . 
 display_name 
 = 
 " PROJECT_ID 
: DATASET_ID 
. TABLE_ID 
" 
 

Replace the following:

• PROJECT_ID : the ID of the project that contains the BigQuery table
• DATASET_ID : the dataset ID of the table
• TABLE_ID : the ID of the table

List all Data sensitivity and Data risk findings for a particular Cloud SQL instance

This query is useful, for example, if Security Command Center detects an event where live Cloud SQL instance data was exported to a Cloud Storage bucket outside of the organization. In this case, an Exfiltration: Cloud SQL Data Exfiltration finding is generated, and it contains the full resource name of the instance that was exfiltrated. You can search for any Data sensitivity and Data risk findings related to the instance. View the calculated sensitivity and data risk levels for the instance and plan your response accordingly.

  state 
 = 
 "ACTIVE" 
 AND 
  
 NOT 
  
 mute 
 = 
 "MUTED" 
 AND 
  
 category 
 = 
 "DATA_RISK" 
  
 OR 
  
 category 
 = 
 "DATA_SENSITIVITY" 
 AND 
  
 resource 
 . 
 name 
 : 
 " INSTANCE_NAME 
" 
 

Replace the following:

• INSTANCE_NAME : a portion of the name of the Cloud SQL instance

List all Data risk and Data sensitivity findings with a High severity level

  state 
 = 
 "ACTIVE" 
 AND 
  
 NOT 
  
 mute 
 = 
 "MUTED" 
 AND 
  
 category 
 = 
 "DATA_RISK" 
  
 OR 
  
 category 
 = 
 "DATA_SENSITIVITY" 
 AND 
  
 severity 
 = 
 "HIGH" 
 

What's next

• Learn about how to Set resource priority values automatically by data sensitivity in Security Command Center.
• Learn how to report the presence of secrets in environment variables to Security Command Center .