Choose the services to enable

This document contains a list of the detection services, sometimes also referred to as security sources, that Security Command Center uses to detect security issues in your cloud environments.

When these services detect an issue, they generate a finding, which is a record that identifies the security issue and provides you with the information you need to prioritize and resolve the issue.

You can view findings in the Google Cloud console and filter them in many different ways, such as by finding type, resource type, or for a specific asset. Each security source might provide more filters to help you organize your findings.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level that you're granted access for. To learn more about Security Command Center roles, see Access control.

Vulnerability detection services

Vulnerability detection services include built-in and integrated services that detect software vulnerabilities, misconfigurations, and posture violations in your cloud environments. Collectively, these types of security issues are referred to as vulnerabilities.

AI Protection

AI Protection helps you manage the security posture of your AI workloads by detecting threats and helping you to mitigate risks to your AI asset inventory.

AI Protection provides the following detection capabilities:

  • Assess your AI asset inventory: Provides visibility into your AI systems and assets, such as models, data sources, endpoints, and AI agents.
  • Identify vulnerabilities: Detects software vulnerabilities (CVEs) in agentic workloads deployed with Agent Runtime.
  • Identify risks: Uses Attack Path Simulation and security graph rules to identify agentic risks and their potential impact on your environment.
  • Detect over-privileged agents: Identifies AI agents that have been granted excessive permissions.
  • Detect and manage threats: Detects and responds to potential threats targeting your AI systems and assets through integrated rules from other Security Command Center services, such as Event Threat Detection and Agent Platform Threat Detection.

For more information, see AI Protection overview.

Artifact Registry vulnerability assessment

Artifact Registry vulnerability assessment is a detection service that alerts you to vulnerabilities in your deployed container images.

This detection service generates vulnerability findings for container images under the following conditions:

  • The container image is stored in Artifact Registry.

  • The container image is deployed to one of the following assets:

    • Google Kubernetes Engine cluster
    • Cloud Run service
    • Cloud Run job
    • App Engine

For more information, see Overview of Artifact Registry vulnerability assessment.

Agent Platform Vulnerability Assessment

Agent Platform Vulnerability Assessment identifies vulnerabilities in agentic workloads and plaintext secrets, such as credentials, keys, access tokens, or certificates, in Gemini Enterprise Agent Platform container images.

Vulnerability detection

Agent Platform Vulnerability Assessment identifies software vulnerabilities (CVEs) in agentic workloads that are deployed with Agent Platform.

This scanner automatically assesses custom code and dependencies within the operational instance during deployment or update.

Enable Agent Platform Vulnerability Assessment

Agent Platform Vulnerability Assessment is automatically enabled for new activations of AI Protection.

If you are an existing customer, you can enable the scanner in the AI Protection settings page. For more information, see Configure Agent Platform Vulnerability Assessment.

View Agent Platform Vulnerability Assessment findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select Vulnerability Assessment for Agent Platform. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

Artifact guard

Artifact guard (Preview) is a service that helps you prevent the deployment of vulnerable packages during the build process. It supports three policy scopes: CI/CD platform, registry and runtime. The CI/CD integration lets you configure connectors to CI/CD platforms. You can use these connectors to configure artifact guard policies to identify vulnerabilities in your CI/CD pipelines.

Compliance Manager findings

Compliance Manager creates findings for the detective and preventive cloud controls that you deploy in your Google Cloud environment. You can view these findings on the Findings page in Security Command Center.

Compliance Manager provides a different set of capabilities for each service tier. For more information, see Compliance Manager overview.

View Compliance Manager findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select Compliance Evaluation Service. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

Data Security Posture Management

Data Security Posture Management (DSPM) creates findings for potential violations of the data security frameworks and cloud controls that you apply in your environment. You can view these findings on the Data Security & Compliance page, the Risk Overview page (under the Data tab), or in the Findings page in Security Command Center. DSPM provides a different set of capabilities for each service tier. For more information, see Data Security Posture Management (DSPM) overview.

View DSPM findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud organization.

  3. Use the following query to view the findings for DSPM:

    state="ACTIVE" AND NOT mute="MUTED" AND resource.name="//aiplatform.googleapis.com/projects/478190632149/locations/us-central1/models/1244151282898305024" AND category="DATA_SECURITY_POSTURE_ACCESS_VIOLATION" OR category="DATA_SECURITY_POSTURE_FLOW_VIOLATION" OR category="DATA_SECURITY_POSTURE_DELETION_VIOLATION" OR category="DATA_SECURITY_POSTURE_PROTECTION_KEY_GOVERNANCE" OR category="BIGQUERY_TABLE_CMEK_DISABLED" OR category="VERTEX_AI_MODEL_CMEK_DISABLED" OR category="VERTEX_AI_METADATA_STORE_CMEK_DISABLED" OR category="VERTEX_AI_DATASET_CMEK_DISABLED" OR category="VERTEX_AI_FEATURE_STORE_TABLE_CMEK_DISABLED" OR category="DATA_SECURITY_POSTURE_CMEK_POLICY_MISCONFIGURED" OR category="DATA_SECURITY_POSTURE_CMEK_POLICY_DELETED" OR category="DATA_SECURITY_POSTURE_CMEK_VIOLATION" OR category="SENSITIVE_DATA_PUBLIC_SQL_INSTANCE" OR category="SENSITIVE_DATA_PUBLIC_DATASET" OR category="SENSITIVE_DATA_BIGQUERY_TABLE_CMEK_DISABLED" OR category="SENSITIVE_DATA_DATASET_CMEK_DISABLED" OR category="SENSITIVE_DATA_SQL_CMEK_DISABLED" OR category="PUBLIC_DATASET" OR category="PUBLIC_SQL_INSTANCE" OR category="SQL_PUBLIC_IP" OR category="ACCESS_TRANSPARENCY_DISABLED" OR category="ORG_POLICY_LOCATION_RESTRICTION" OR category="BUCKET_POLICY_ONLY_DISABLED" OR category="DATA_EXFILTRATION_BIG_QUERY" OR category="DATA_EXFILTRATION_BIG_QUERY_EXTRACTION" OR category="DATA_EXFILTRATION_BIG_QUERY_TO_GOOGLE_DRIVE"

  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.

  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.

  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

External Exposure

Security Command Center External Exposure is a Google Cloud service that helps you manage and reduce your external attack surface through automated discovery and risk validation.

Because automated scanners can target internet-exposed assets within minutes, External Exposure proactively uncovers accidental exposures and shadow resources before attackers can discover and exploit them.

By analyzing your environment from an external perspective, the service attempts to confirm what is truly reachable from the internet and identifies which exposures are actually exploitable.

External Exposure continually scans for external-facing IP addresses, hostnames, domain names, and URLs across your Google Cloud environment. This feature uses network scanning to confirm which resources and applications are reachable from the public internet.

For each confirmed exposure, External Exposure does the following:

  • Traces and displays the Google Cloud network path for external load balancers, Google Cloud Armor policies, firewall rules, Private Service Connect, Cloud Interconnect, and backend services down to the exposed resource.

    This resource can be a Compute Engine instance or a Google Kubernetes Engine (GKE) Pod, including an exposed service or application.

    This deep integration with the Google networking fabric helps provide actionable context so you can immediately apply preventive mitigations, such as locking down a specific firewall rule or configuring Google Cloud Armor.

  • Performs fingerprinting to attempt to identify the specific web application or server software that is running on each exposed asset.

  • If it can identify the exposed service or software, identifies any vulnerabilities that are known to affect it.

  • Uses advanced passive and active detectors to test for real-world exploitability by validating vulnerabilities, misconfigurations, and use of default or weak credentials.

Review External Exposure findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select External Exposure. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

GKE security posture dashboard

The Google Kubernetes Engine (GKE) security posture dashboard is a page in the Google Cloud console that provides you with prescriptive and actionable findings about potential security issues in your GKE clusters.

The GKE security posture dashboard integrates with Security Command Center to provide the following benefits:

  • Unified visibility: View security findings for your GKE clusters alongside findings from other Security Command Center services in the Security Command Center console.
  • Attack exposure scores: Prioritize findings by viewing their potential impact on your environment through attack exposure scores.
  • Compliance reporting: Generate compliance reports based on the findings.

To see these findings, enable any of the following GKE security posture dashboard features:

GKE security posture dashboard pane Security Command Center finding class
Workload configuration auditing1 MISCONFIGURATION
Top threats2 THREAT
Container OS vulnerability scanning1 VULNERABILITY
Language package vulnerability scanning1 VULNERABILITY
Actionable security bulletins1 (Preview) VULNERABILITY
Top software vulnerabilities2 VULNERABILITY
  1. Available only if you enable this feature in GKE.
  2. Available for Security Command Center Premium and Enterprise service tiers.

The findings display information about the security issue and provide recommendations to resolve them in your workloads or clusters.

View GKE security posture dashboard findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select GKE Security Posture. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

IAM recommender

IAM recommender generates recommendations that you can follow to improve security by removing or replacing IAM roles from principals when the roles contain IAM permissions that the principal does not need.

IAM recommender is automatically enabled when you activate Security Command Center.

Enable or disable IAM recommender findings

To enable or disable IAM recommender findings in Security Command Center, follow these steps:

  1. Go to the Integrated services tab of the Security Command Center Settings page in the Google Cloud console:

    Go to Integrated Services

  2. Go to the IAM recommender entry.

  3. To the right of the entry, select Enable or Disable.

Findings from IAM recommender are classified as vulnerabilities.

To remediate an IAM recommender finding, expand the following section to see a table of the IAM recommender findings. The remediation steps for each finding are included in the table entry.

View IAM recommender findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select IAM Recommender. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

In Security Command Center Premium, you can also view the IAM recommender findings on the legacy Vulnerabilities page by selecting the IAM recommender query preset.

Mandiant Attack Surface Management

Mandiant is a world leader in frontline threat intelligence. Mandiant Attack Surface Management identifies vulnerabilities and misconfigurations in your external attack surfaces to help you stay up-to-date against the latest cyber attacks.

Mandiant Attack Surface Management is automatically enabled when you activate the Security Command Center Enterprise tier and findings are available in the Google Cloud console.

For information about how the standalone Mandiant Attack Surface Management product differs from the Mandiant Attack Surface Management integration within Security Command Center, see ASM and Security Command Center on the Mandiant documentation portal. This link requires Mandiant authentication.

Review Mandiant Attack Surface Management findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select Mandiant Attack Surface Management. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

Neither Security Command Center nor Mandiant Attack Surface Management marks findings as resolved. Once you resolve an issue, you can manually mark the issue resolved. If it is not identified in the next Mandiant Attack Surface Management scan, it stays resolved.

Model Armor

Model Armor is a fully managed Google Cloud service that enhances the security and safety of AI applications by screening LLM prompts and responses.

Vulnerability findings from the Model Armor service

Finding Summary

Category name in the API: FLOOR_SETTINGS_VIOLATION

Finding description: A floor setting violation that occurs when a Model Armor template fails to meet the minimum security standards defined by the resource hierarchy floor settings.

Pricing tier: Premium

Fix this finding:

This finding requires that you update the Model Armor template to be in conformance with the floor settings defined at the resource hierarchy.

Category name in the API: GEMINI_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR

Previous name: VERTEX_AI_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR

Finding description: A Gemini foundation model detected in Gemini Enterprise Agent Platform is not protected by Model Armor.

Pricing tier: Premium

Fix this finding:

To fix this finding, configure Model Armor for the detected model. For more information, see Create and manage templates.

Observation findings from the Model Armor service

AI Protection generates observation findings for foundation models that are protected by Model Armor.

Finding Summary

Category name in the API: GEMINI_MODEL_DETECTED

Previous name: VERTEX_AI_MODEL_DETECTED

Finding description: A foundation model was detected in Gemini Enterprise Agent Platform and is protected by Model Armor.

Pricing tier: Premium

Notebook Security Scanner

Notebook Security Scanner is a built-in package vulnerability detection service of Security Command Center. After Notebook Security Scanner is enabled, it automatically scans Colab Enterprise notebooks (files with the ipynb filename extension) every 24 hours to detect vulnerabilities in Python packages and publishes these findings to the Security Command Center Findings page.

You can use Notebook Security Scanner for Colab Enterprise notebooks that are created in the following regions: us-central1, us-east4, us-west1, and europe-west4.

To get started with Notebook Security Scanner, see Enable and use Notebook Security Scanner.

Policy Controller

Policy Controller enables the application and enforcement of programmable policies for your Kubernetes clusters. These policies act as guardrails and can help with best practices, security, and compliance management of your clusters and fleet.

If you install Policy Controller, and enable any of the Policy Controller bundles, Policy Controller automatically writes cluster violations to Security Command Center as Misconfiguration class findings. The finding description and next steps in the Security Command Center findings are the same as the constraint description and remediation steps of the corresponding Policy Controller bundle.

The Policy Controller findings come from the following Policy Controller bundles:

To find and remediate Policy Controller findings, see Remediating Policy Controller findings.

Risk Engine

The Security Command Center Risk Engine assesses the risk exposure of your cloud deployments, assigns attack exposure scores to vulnerability findings and your high-value resources, and diagrams paths that a potential attacker could take to reach your high-value resources.

In the Enterprise or Premium tier of Security Command Center, the Risk Engine detects groups of security issues that, when they occur together in a particular pattern, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources.

When Risk Engine detects one of these combinations, it generates a TOXIC_COMBINATION class finding. In the finding, Risk Engine is listed as the source of the finding.

Risk Engine also identifies common resources or resource groups where multiple attack paths converge, and then generates a CHOKEPOINT class finding.

For more information, see Toxic combinations and chokepoints overview.

Security Health Analytics

Security Health Analytics is a built-in detection service of Security Command Center that provides managed scans of your cloud resources to detect common misconfigurations.

When a misconfiguration is detected, Security Health Analytics generates a finding. Most Security Health Analytics findings are mapped to security standard controls so that you can assess compliance.

Security Health Analytics scans your resources on Google Cloud. If you are using the Enterprise tier and establish connections to other cloud platforms, Security Health Analytics can also scan your resources on those cloud platforms.

Depending on the Security Command Center service tier you are using, the available detectors differ:

  • In the Standard-legacy tier, Security Health Analytics includes only a basic group of medium-severity and high-severity vulnerability detectors.
  • The Premium tier includes all vulnerability detectors for Google Cloud.
  • The Enterprise tier includes additional detectors for other cloud platforms.

Security Health Analytics is automatically enabled when you activate Security Command Center.

For more information, see the following:

Security posture service

The security posture service is a built-in service for the Security Command Center Premium tier that lets you define, assess, and monitor the overall status of your security in Google Cloud. It provides information about how your environment aligns with the policies that you define in your security posture.

The security posture service isn't related to the GKE security posture dashboard, which only shows findings in GKE clusters.

Sensitive Data Protection

Sensitive Data Protection is a fully managed Google Cloud service that helps you discover, classify, and protect your sensitive data. You can use Sensitive Data Protection to determine whether you're storing sensitive or personally identifiable information (PII), like the following:

  • Person names
  • Credit card numbers
  • National or state ID numbers
  • Health insurance ID numbers
  • Secrets

In Sensitive Data Protection, each type of sensitive data that you search for is called an infoType.

If you configure your Sensitive Data Protection operation to send results to Security Command Center, you can see the findings directly in the Security Command Center section of the Google Cloud console, in addition to the Sensitive Data Protection section.

If you use VPC Service Controls service perimeters and you want to discover sensitive data within those perimeters, see Allow sensitive data discovery within service perimeters. If you don't perform this task, you might receive warnings.

Vulnerability findings from the Sensitive Data Protection discovery service

The Sensitive Data Protection discovery service helps you determine whether you are storing highly sensitive data that is not protected.

Category Summary

Category name in the API:

PUBLIC_SENSITIVE_DATA

Finding description: The specified resource has high-sensitivity data that can be accessed by anyone on the internet.

Supported assets:

  • aiplatform.googleapis.com/Dataset
  • aiplatform.googleapis.com/TuningJob
  • bigquery.googleapis.com/Dataset
  • bigquery.googleapis.com/Table
  • sqladmin.googleapis.com/Instance
  • storage.googleapis.com/Bucket
  • Amazon S3 bucket
  • Azure Blob Storage container

Remediation:

For Google Cloud data, remove allUsers and allAuthenticatedUsers from the data asset's IAM policy.

For Amazon S3 data, configure block public access settings or update the object's ACL to deny public read access. For more information, see Configuring block public access settings for your S3 buckets and Configuring ACLs in the AWS documentation.

For Azure Blob Storage data, remove public access to the container and the blobs. For more information, see Overview: Remediating anonymous read access for blob data in the Azure documentation.

Compliance standards: Not mapped

Category name in the API:

SECRETS_IN_ENVIRONMENT_VARIABLES

Finding description: There are secrets—such as passwords, authentication tokens, and Google Cloud credentials—in environment variables.

To enable this detector, see Report secrets in environment variables to Security Command Center in the Sensitive Data Protection documentation.

Supported assets:

Remediation:

For Cloud Run functions environment variables, remove the secret from the environment variable and store it in Secret Manager instead.

For Cloud Run service revision environment variables, move all traffic off of the revision, and then delete the revision.

Compliance standards:

  • CIS GCP Foundation 1.3: 1.18
  • CIS GCP Foundation 2.0: 1.18

Category name in the API:

SECRETS_IN_STORAGE

Finding description: There are secrets—such as passwords, authentication tokens, and cloud credentials—in the specified resource.

Supported assets:

  • aiplatform.googleapis.com/Dataset
  • aiplatform.googleapis.com/TuningJob
  • bigquery.googleapis.com/Dataset
  • bigquery.googleapis.com/Table
  • sqladmin.googleapis.com/Instance
  • storage.googleapis.com/Bucket
  • Amazon S3 bucket
  • Azure Blob Storage container

Remediation:

  1. For Google Cloud data, use Sensitive Data Protection to run a deep inspection scan of the specified resource to identify all affected resources. For Cloud SQL data, export that data to a CSV or AVRO file in a Cloud Storage bucket and run a deep inspection scan of the bucket.

    For data from other cloud providers, manually inspect the specified bucket or container.

  2. Remove the detected secrets.
  3. Consider resetting the credentials.
  4. For Google Cloud data, consider storing the detected secrets in Secret Manager instead.

Compliance standards: Not mapped

Misconfiguration findings from the Sensitive Data Protection discovery service

The Sensitive Data Protection discovery service helps you determine whether you have misconfigurations that might expose sensitive data.

Category Summary

Category name in the API:

SENSITIVE_DATA_CMEK_DISABLED

Finding description: The specified resource has high-sensitivity or moderate-sensitivity data and the resource isn't using a customer-managed encryption key (CMEK).

Supported assets:

  • aiplatform.googleapis.com/Dataset
  • bigquery.googleapis.com/Dataset
  • bigquery.googleapis.com/Table
  • sqladmin.googleapis.com/Instance
  • storage.googleapis.com/Bucket
  • Amazon S3 bucket
  • Azure Blob Storage container

Remediation:

Compliance standards: Not mapped

Observation findings from Sensitive Data Protection

This section describes the observation findings that Sensitive Data Protection generates in Security Command Center.

Observation findings from the discovery service

The Sensitive Data Protection discovery service helps you determine whether your data contains specific infoTypes and where they reside in your organization, folders, and projects. It generates the following observation finding categories in Security Command Center:

Data sensitivity
An indication of the sensitivity level of the data in a particular data asset. Data is sensitive if it contains PII or other elements that might require additional control or management. The severity of the finding is the sensitivity level that Sensitive Data Protection calculated when generating the data profile.
Data risk
The risk associated with the data in its current state. When calculating data risk, Sensitive Data Protection considers the sensitivity level of the data in the data asset and the presence of access controls to protect that data. The severity of the finding is the data risk level that Sensitive Data Protection calculated when generating the data profile.

Depending on the size of your organization, Sensitive Data Protection findings can start appearing in Security Command Center within a few minutes after you enable sensitive data discovery. For larger organizations or organizations with specific configurations that affect finding generation, it can take up to 12 hours before initial findings appear in Security Command Center.

Subsequently, Sensitive Data Protection generates findings in Security Command Center within a few minutes after the discovery service scans your resources.

For information about how to send data profile results to Security Command Center, see Enable sensitive data discovery.

Observation findings from the Sensitive Data Protection inspection service

A Sensitive Data Protection inspection job identifies each instance of data of a specific infoType in a storage system like a Cloud Storage bucket or a BigQuery table. For example, you can run an inspection job that searches for all strings that match the CREDIT_CARD_NUMBER infoType detector in a Cloud Storage bucket.

For each infoType detector that has one or more matches, Sensitive Data Protection generates a corresponding Security Command Center finding. The finding category is the name of the infoType detector that had a match—for example, Credit card number. The finding includes the number of matching strings that were detected in text or images in the resource.

For security reasons, the actual strings that were detected aren't included in the finding. For example, a Credit card number finding shows how many credit card numbers were found, but doesn't show the actual credit card numbers.

Because there are more than 150 built-in infoType detectors in Sensitive Data Protection, all possible Security Command Center finding categories aren't listed here. For a full list of infoType detectors, see InfoType detector reference.

For information on how to send the results of an inspection job to Security Command Center, see Send Sensitive Data Protection inspection job results to Security Command Center.

Review Sensitive Data Protection findings in the console

  1. In the Google Cloud console, go to the Findings page of Security Command Center.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. In the Quick filters section, in the Source display name subsection, select Sensitive Data Protection. The findings query results are updated to show only the findings from this source.
  4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
  5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
  6. Optional: To view the full JSON definition of the finding, click the JSON tab.

VM Manager

VM Manager is a suite of tools that can be used to manage operating systems for large virtual machine (VM) fleets running Windows and Linux on Compute Engine.

To use VM Manager with project-level activations of Security Command Center Premium, activate the Security Command Center Standard-legacy tier in the parent organization.

If you enable VM Manager with the Security Command Center Premium tier, VM Manager automatically writes high and critical findings from its vulnerability reports, which are in preview, to Security Command Center. The reports identify vulnerabilities in operating systems (OS) that are installed on VMs, including Common Vulnerabilities and Exposures (CVEs).

Vulnerability reports are not available for the Security Command Center Standard-legacy tier.

Findings simplify the process of using VM Manager's Patch Compliance feature (Preview). When integrated with the Security Command Center Premium tier, the feature enables organization-level visibility and patch management across all your projects. Although individual patch jobs are configured within VM Manager at the project level, Security Command Center provides a consolidated view that helps you manage patch jobs across your organization.

To remediate VM Manager findings, see Remediating VM Manager findings.

To stop vulnerability reports from being written to Security Command Center, see Mute VM Manager findings.

Vulnerabilities of this type all relate to installed operating system packages in supported Compute Engine VMs.

Detector Summary Asset scan settings

Category name in the API: OS_VULNERABILITY

Finding description: VM Manager detected a vulnerability in the installed operating system (OS) package for a Compute Engine VM.

Pricing tier: Premium

Supported assets

compute.googleapis.com/Instance

Fix this finding

VM Manager's vulnerability reports detail vulnerabilities in installed operating system packages for Compute Engine VMs, including Common Vulnerabilities and Exposures (CVEs).

For a complete list of supported operating systems, see Operating system details.

Findings appear in Security Command Center shortly after vulnerabilities are detected. Vulnerability reports in VM Manager are generated as follows:

  • When a package is installed or updated in a VM's operating system, you can expect to see Common Vulnerabilities and Exposures (CVEs) information for the VM in Security Command Center within two hours after the change.
  • When new security advisories are published for an operating system, updated CVEs are normally available within 24 hours after the operating system vendor publishes the advisory.

Vulnerability Assessment for AWS

The Vulnerability Assessment for Amazon Web Services (AWS) service detects software vulnerabilities in your workloads that are running on EC2 virtual machines (VMs) on the AWS cloud platform.

For each detected vulnerability, Vulnerability Assessment for AWS generates a Vulnerability class finding in the Software vulnerability finding category in Security Command Center.

The Vulnerability Assessment for AWS service scans snapshots of the running EC2 machine instances, so production workloads are unaffected. This scan method is called agentless disk scanning, because no agents are installed on the scan targets.

For more information, see the following:

Vulnerability Assessment for Google Cloud

The Vulnerability Assessment for Google Cloud service detects software vulnerabilities in the following resources on the Google Cloud platform:

  • Running Compute Engine VM instances
  • Nodes in GKE Standard clusters
  • Containers running in GKE Standard and GKE Autopilot clusters

For each detected vulnerability, Vulnerability Assessment for Google Cloud generates a Vulnerability class finding in the Software vulnerability or OS vulnerability finding category in Security Command Center.

The Vulnerability Assessment for Google Cloud service scans your Compute Engine VM instances by cloning their disks approximately every 12 hours, mounting them in a secure VM instance, and assessing them with the SCALIBR scanner.

For more information, see Vulnerability Assessment for Google Cloud.

Web Security Scanner

Web Security Scanner provides managed and custom web vulnerability scanning for public App Engine, GKE, and Compute Engine serviced web applications.

Managed scans

Web Security Scanner managed scans are configured and managed by Security Command Center. Managed scans automatically run once each week to detect and scan public web endpoints. These scans don't use authentication and they send GET-only requests so they don't submit any forms on live websites.

Managed scans run separately from custom scans.

If Security Command Center is activated at the organization level, you can use managed scans to centrally manage basic web application vulnerability detection for projects in your organization, without having to involve individual project teams. When findings are discovered, you can work with those teams to set up more comprehensive custom scans.

When you enable Web Security Scanner as a service, managed scan findings are automatically available in the Security Command Center Vulnerabilities page and related reports. For information about how to enable Web Security Scanner managed scans, see Configure Security Command Center services.

Managed scans support only applications that use the default port, which is 80 for HTTP connections and 443 for HTTPS connections. If your application uses a non-default port, do a custom scan instead.

Custom scans

Web Security Scanner custom scans provide granular information about application vulnerability findings, like outdated libraries, cross-site scripting, or use of mixed content.

You define custom scans at the project level.

Custom scan findings are available in Security Command Center after you complete the guide to set up Web Security Scanner custom scans.

Detectors and compliance

Web Security Scanner supports categories in the OWASP Top Ten, a document that ranks and provides remediation guidance for the top 10 most critical web application security risks, as determined by the Open Web Application Security Project (OWASP). For guidance on mitigating OWASP risks, see OWASP Top 10 mitigation options on Google Cloud.

The compliance mapping is included for reference and is not provided or reviewed by the OWASP Foundation.

This functionality is only intended for you to monitor for compliance control violations. The mappings are not provided for use as the basis of, or as a substitute for, the audit, certification, or report of compliance of your products or services with any regulatory or industry benchmarks or standards.

For more information, see Web Security Scanner Overview.

Threat detection services

Threat detection services include built-in and integrated services that detect events that might indicate potentially harmful events, such as compromised resources or cyberattacks.

Agent Platform Threat Detection

Agent Platform Threat Detection provides runtime threat detection for agents deployed to Agent Runtime. It monitors running agents for potential attacks and generates findings in Security Command Center.

Agent Platform Threat Detection can generate findings for Agent Runtime including the following categories:

  • Command and Control: Steganography Tool Detected
  • Credential Access: Find Google Cloud Credentials
  • Credential Access: GPG Key Reconnaissance
  • Credential Access: Search Private Keys or Passwords
  • Defense Evasion: Base64 ELF File Command Line
  • Defense Evasion: Base64 Encoded Python Script Executed
  • Defense Evasion: Base64 Encoded Shell Script Executed
  • Defense Evasion: Launch Code Compiler Tool In Container
  • Execution: Netcat Remote Code Execution in Container
  • Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)
  • Execution: Possible Remote Command Execution Detected
  • Execution: Program Run with Disallowed HTTP Proxy Env
  • Execution: Socat Reverse Shell Detected
  • Execution: Suspicious OpenSSL Shared Object Loaded
  • Exfiltration: Launch Remote File Copy Tools in Container
  • Impact: Detect Malicious Cmdlines
  • Impact: Remove Bulk Data from Disk
  • Impact: Suspicious crypto mining activity using the Stratum Protocol
  • Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)
  • Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
  • Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
  • Execution: Malicious Python executed
  • Execution: Container Escape
  • Execution: Kubernetes Attack Tool Execution
  • Execution: Local Reconnaissance Tool Execution
  • Impact: Malicious Script Executed
  • Impact: Malicious URL Observed
  • Execution: Unexpected Child Shell

Learn more about Agent Platform Threat Detection.

Anomaly Detection

Anomaly Detection is a built-in service that uses behavior signals from outside your system. It displays granular information about security anomalies detected for your service accounts, such as potential leaked credentials. Anomaly Detection is automatically enabled when you activate Security Command Center Standard-legacy or Premium tier, and findings are available in the Google Cloud console.

Anomaly Detection findings include the following:

Anomaly name Finding category Description
account_has_leaked_credentials

Credentials for a Google Cloud service account are accidentally leaked online or are compromised.

Severity: Critical

Account has leaked credentials

GitHub notified Security Command Center that the credentials that were used for a commit appear to be the credentials for a Google Cloud Identity and Access Management service account.

The notification includes the service account name and the private key identifier. Google Cloud also sends your designated contact for security and privacy issues a notification by email.

To remediate this issue, take one or more of the following actions:

  • Identify the legitimate user of the key.
  • Rotate the key.
  • Remove the key.
  • Investigate any actions that were taken by the key after the key was leaked to ensure that none of the actions were malicious.

JSON: leaked account credentials finding

{
  "findings": {
    "access": {},
    "assetDisplayName": "PROJECT_NAME",
    "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
    "canonicalName": "projects/PROJECT_ID/sources/SOURCE_INSTANCE_ID/findings/FINDING_ID",
    "category": "account_has_leaked_credentials",
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "EMAIL_ADDRESS"
          }
        ]
      }
    },
    "createTime": "2022-08-05T20:59:41.022Z",
    "database": {},
    "eventTime": "2022-08-05T20:59:40Z",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/cat",
    "indicator": {},
    "kubernetes": {},
    "mitreAttack": {},
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_INSTANCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_INSTANCE_ID",
    "parentDisplayName": "Cloud Anomaly Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
    "severity": "CRITICAL",
    "sourceDisplayName": "Cloud Anomaly Detection",
    "state": "ACTIVE",
    "vulnerability": {},
    "workflowState": "NEW"
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
    "display_name": "PROJECT_NAME",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
    "project_display_name": "PROJECT_NAME",
    "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parent_display_name": "ORGANIZATION_NAME",
    "type": "google.cloud.resourcemanager.Project",
    "folders": []
  },
  "sourceProperties": {
    "project_identifier": "PROJECT_ID",
    "compromised_account": "SERVICE_ACCOUNT_NAME@PROJECT_ID.",
    "finding_type": "Potential compromise of a resource in your organization.",
    "summary_message": "We have detected leaked Service Account authentication credentials that could be potentially compromised.",
    "action_taken": "Notification sent",
    "private_key_identifier": "SERVICE_ACCOUNT_KEY_ID",
    "url": "https://github.com/KEY_FILE_PATH/KEY_FILE_NAME.json"
  }
}

Container Threat Detection

Container Threat Detection can detect the most common container runtime attacks and alert you in Security Command Center and optionally in Cloud Logging. Container Threat Detection includes several detection capabilities, an analysis tool, and an API.

Container Threat Detection detection instrumentation collects low-level behavior in the guest kernel and performs natural language processing on code to detect the following events:

  • Added Binary Executed
  • Added Library Loaded
  • Command and Control: Steganography Tool Detected (Preview)
  • Credential Access: Find Google Cloud Credentials
  • Credential Access: GPG Key Reconnaissance
  • Credential Access: Search Private Keys or Passwords
  • Defense Evasion: Base64 ELF File Command Line
  • Defense Evasion: Base64 Encoded Python Script Executed
  • Defense Evasion: Base64 Encoded Shell Script Executed
  • Defense Evasion: Launch Code Compiler Tool In Container (Preview)
  • Execution: Added Malicious Binary Executed
  • Execution: Added Malicious Library Loaded
  • Execution: Built in Malicious Binary Executed
  • Execution: Container Escape
  • Execution: Fileless Execution in /memfd:
  • Execution: Ingress Nightmare Vulnerability Execution (Preview)
  • Execution: Kubernetes Attack Tool Execution
  • Execution: Local Reconnaissance Tool Execution
  • Execution: Malicious Python executed
  • Execution: Modified Malicious Binary Executed
  • Execution: Modified Malicious Library Loaded
  • Execution: Netcat Remote Code Execution In Container
  • Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47076)
  • Execution: Possible Remote Command Execution Detected (Preview)
  • Execution: Program Run with Disallowed HTTP Proxy Env
  • Execution: Socat Reverse Shell Detected
  • Execution: Suspicious OpenSSL Shared Object Loaded
  • Exfiltration: Launch Remote File Copy Tools in Container
  • Impact: Detect Malicious Cmdlines (Preview)
  • Impact: Remove Bulk Data From Disk
  • Impact: Suspicious crypto mining activity using the Stratum Protocol
  • Malicious Script Executed
  • Malicious URL Observed
  • Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)
  • Privilege Escalation: Fileless Execution in /dev/shm
  • Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
  • Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
  • Reverse Shell
  • Unexpected Child Shell

Learn more about Container Threat Detection.

Event Threat Detection

Event Threat Detection uses log data from inside your systems. It watches the Cloud Logging stream for projects, and consumes logs as they become available. When a threat is detected, Event Threat Detection writes a finding to Security Command Center and to a Cloud Logging project. Event Threat Detection is automatically enabled when you activate the Security Command Center and findings are available in the Google Cloud console.

Event Threat Detection detectors

Learn more about Event Threat Detection.

Google Cloud Armor

Cloud Armor helps protect your application by providing Layer 7 filtering. Cloud Armor scrubs incoming requests for common web attacks or other Layer 7 attributes to potentially block traffic before it reaches your load-balanced backend services or backend buckets.

Cloud Armor exports two findings to Security Command Center:

Virtual Machine Threat Detection

Virtual Machine Threat Detection is a built-in service of Security Command Center. This service scans virtual machines to detect potentially malicious applications, such as cryptocurrency mining software, kernel-mode rootkits, and malware running in compromised cloud environments.

VM Threat Detection is part of the Security Command Center threat detection suite and is designed to complement the existing capabilities of Event Threat Detection and Container Threat Detection.

For more information about VM Threat Detection, see VM Threat Detection overview.

VM Threat Detection threat findings

VM Threat Detection can generate the following threat findings.

Cryptocurrency mining threat findings

VM Threat Detection detects the following finding categories through hash matching or YARA rules.

VM Threat Detection cryptocurrency mining threat findings
Category Module Description
CRYPTOMINING_HASH Matches memory hashes of running programs against known memory hashes of cryptocurrency mining software. Findings are classified as High severity by default.
CRYPTOMINING_YARA Matches memory patterns, such as proof-of-work constants, known to be used by cryptocurrency mining software. Findings are classified as High severity by default.
  • CRYPTOMINING_HASH
  • CRYPTOMINING_YARA
 Identifies a threat that was detected by both the CRYPTOMINING_HASH and CRYPTOMINING_YARA modules. For more information, see Combined detections. Findings are classified as High severity by default.

Kernel-mode rootkit threat findings

VM Threat Detection analyzes kernel integrity at run time to detect common evasion techniques that are used by malware.

The KERNEL_MEMORY_TAMPERING module detects threats by doing a hash comparison on the kernel code and kernel read-only data memory of a virtual machine.

The KERNEL_INTEGRITY_TAMPERING module detects threats by checking the integrity of important kernel data structures.

VM Threat Detection kernel-mode rootkit threat findings
Category Module Description
Rootkit
  • KERNEL_MEMORY_TAMPERING
  • KERNEL_INTEGRITY_TAMPERING
 A combination of signals matching a known kernel-mode rootkit is present. To receive findings of this category, make sure both modules are enabled. Findings are classified as High severity by default.
Kernel memory tampering
KERNEL_MEMORY_TAMPERING Unexpected modifications of kernel read-only data memory are present. Findings are classified as High severity by default.
Kernel integrity tampering
KERNEL_INTEGRITY_TAMPERING ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range. Findings are classified as High severity by default.
KERNEL_INTEGRITY_TAMPERING Interrupt handlers that aren't in the expected kernel or module code regions are present. Findings are classified as High severity by default.
KERNEL_INTEGRITY_TAMPERING Kernel code pages that are not in the expected kernel or module code regions are present. Findings are classified as High severity by default.
KERNEL_INTEGRITY_TAMPERING kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range. Findings are classified as High severity by default.
KERNEL_INTEGRITY_TAMPERING Unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list. Findings are classified as High severity by default.
KERNEL_INTEGRITY_TAMPERING System call handlers that aren't in the expected kernel or module code regions are present. Findings are classified as High severity by default.

Errors

Error detectors can help you detect errors in your configuration that prevent security sources from generating findings. Error findings are generated by the Security Command Center security source and have the finding class SCC errors.

Inadvertent actions

The following finding categories represent errors possibly caused by unintentional actions.

Inadvertent actions
Category name API name Summary Severity
API_DISABLED

Finding description: A required API is disabled for the project. The disabled service can't send findings to Security Command Center.

Pricing tier: Premium or Standard

Supported assets
cloudresourcemanager.googleapis.com/Project

Batch scans: Every 60 hours

Fix this finding

Critical
APS_NO_RESOURCE_VALUE_CONFIGS_MATCH_ANY_RESOURCES

Finding description: Resource value configurations are defined for attack path simulations, but they do not match any resource instances in your environment. The simulations are using the default high-value resource set instead.

This error can have any of the following causes:

  • None of the resource value configurations match any resource instances.
  • One or more resource value configurations that specify NONE override every other valid configuration.
  • All the defined resource value configurations specify a value of NONE.

Pricing tier: Premium

Supported assets
cloudresourcemanager.googleapis.com/Organizations

Batch scans: Before every attack path simulation.

Fix this finding

Critical
APS_RESOURCE_VALUE_ASSIGNMENT_LIMIT_EXCEEDED

Finding description: In the last attack path simulation, the number of high-value resource instances, as identified by the resource value configurations, exceeded the limit of 1,000 resource instances in a high-value resource set. As a result, Security Command Center excluded the excess number of instances from the high-value resource set.

The total number of matching instances and the total number of instances excluded from the set are identified in the SCC Error finding in the Google Cloud console.

The attack exposure scores on any findings that affect excluded resource instances do not reflect the high-value designation of the resource instances.

Pricing tier: Premium

Supported assets
cloudresourcemanager.googleapis.com/Organizations

Batch scans: Before every attack path simulation.

Fix this finding

High
KTD_IMAGE_PULL_FAILURE

Finding description: Container Threat Detection can't be enabled on the cluster because a required container image can't be pulled (downloaded) from gcr.io, the Container Registry image host. The image is needed to deploy the Container Threat Detection DaemonSet that Container Threat Detection requires.

The attempt to deploy the Container Threat Detection DaemonSet resulted in the following error:

Failed to pull image "badurl.gcr.io/watcher-daemonset:ktd_release.watcher_20220831_RC00": rpc error: code = NotFound desc = failed to pull and unpack image "badurl.gcr.io/watcher-daemonset:ktd_release.watcher_20220831_RC00": failed to resolve reference "badurl.gcr.io/watcher-daemonset:ktd_release.watcher_20220831_RC00": badurl.gcr.io/watcher-daemonset:ktd_release.watcher_20220831_RC00: not found

Pricing tier: Premium

Supported assets
container.googleapis.com/Cluster

Batch scans: Every 30 minutes

Fix this finding

Critical
KTD_BLOCKED_BY_ADMISSION_CONTROLLER

Finding description: Container Threat Detection can't be enabled on a Kubernetes cluster. A third-party admission controller is preventing the deployment of a Kubernetes DaemonSet object that Container Threat Detection requires.

When viewed in the Google Cloud console, the finding details include the error message that was returned by Google Kubernetes Engine when Container Threat Detection attempted to deploy a Container Threat Detection DaemonSet Object.

Pricing tier: Premium

Supported assets
container.googleapis.com/Cluster

Batch scans: Every 30 minutes

Fix this finding

High
KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS

Finding description: A service account is missing permissions that Container Threat Detection requires. Container Threat Detection could stop functioning properly because the detection instrumentation cannot be enabled, upgraded, or disabled.

Pricing tier: Premium

Supported assets
cloudresourcemanager.googleapis.com/Project

Batch scans: Every 30 minutes

Fix this finding

Critical
GKE_SERVICE_ACCOUNT_MISSING_PERMISSIONS

Finding description: Container Threat Detection can't generate findings for a Google Kubernetes Engine cluster, because the GKE default service account on the cluster is missing permissions. This prevents Container Threat Detection from being successfully enabled on the cluster.

Pricing tier: Premium

Supported assets
container.googleapis.com/Cluster

Batch scans: Every week

Fix this finding

High
MISCONFIGURED_CLOUD_LOGGING_EXPORT

Finding description: The project configured for continuous export to Cloud Logging is unavailable. Security Command Center can't send findings to Logging.

Pricing tier: Premium

Supported assets
cloudresourcemanager.googleapis.com/Organization

Batch scans: Every 30 minutes

Fix this finding

High
VPC_SC_RESTRICTION

Finding description: Security Health Analytics can't produce certain findings for a project. The project is protected by a service perimeter, and the Security Command Center service account doesn't have access to the perimeter.

Pricing tier: Premium or Standard

Supported assets
cloudresourcemanager.googleapis.com/Project

Batch scans: Every 6 hours

Fix this finding

High
EXTERNAL_EXPOSURE_VPC_SC_RESTRICTION

Finding description: External Exposure can't perform scans or generate findings for a project. The project is protected by a service perimeter, and the External Exposure service agent doesn't have access to the perimeter.

Pricing tier: Premium

Supported assets
cloudresourcemanager.googleapis.com/Project

Batch scans: Every 12 hours

Fix this finding

High
SCC_SERVICE_ACCOUNT_MISSING_PERMISSIONS

Finding description: The Security Command Center service account is missing permissions required to function properly. No findings are produced.

Pricing tier: Premium or Standard

Supported assets

Batch scans: Every 30 minutes

Fix this finding

Critical

For more information, see Security Command Center errors.

Application lifecycle security assessments

You can integrate proactive security assessments directly into your application development lifecycle by using Application Design Center (App Design Center) with Security Command Center.

This integration focuses on the following primary concepts.

Design-time and runtime findings

  • Design-time findings: Originate from scans of Infrastructure as Code (IaC) templates and applications within App Design Center before resources are deployed.
  • Runtime findings: Originate from resources that are deployed in your cloud environment.

Security Command Center shows both types of findings to help provide a unified view of your application's security posture.

Managed and unmanaged applications

Security Command Center uses the following terms to differentiate applications based on how they're deployed:

Managed applications
Applications that you design by using App Design Center. These applications support design-time assessments.
Unmanaged applications
Applications that are registered in App Hub but not managed by App Design Center. These applications support runtime monitoring and risk prioritization in Security Command Center, but don't support design-time assessments.

Pre-deployment assessment points

You can perform security assessments at several stages of the application lifecycle within App Design Center:

  1. Design phase: On-demand assessments when you edit a template or application.
  2. Publish phase: Automatic assessments when you publish templates to a Service Catalog.
  3. Deploy phase: A final assessment check before you provision resources.

App Hub

Security Command Center and Compliance Manager let you view findings, issues, and compliance information for resources within a specific App Hub application. You can filter investigative views to view data for only those resources that are registered to an App Hub application.

You can filter in the following investigative views:

  • Risk Overview > All risk dashboard
  • Risk Overview > Data dashboard
  • Findings page
  • Issues page
  • Compliance > Monitor (New) tab
  • Compliance > Monitor (New) > Framework Details page

When viewing data at the organization level, you can use the Select app menu to filter the view. This menu lists applications that are created in App Hub and deployed in the same organization where Security Command Center is active. Information in the Select app menu is retrieved from Cloud Asset Inventory and App Hub.

The Select app menu is not available when viewing data for a single project or folder.

What's next