Security Command Center

# Check your organization ID
gcloud organizations list

# Verify you have the required role
gcloud organizations get-iam-policy ORGANIZATION_ID \
  --filter="bindings.role:roles/securitycenter.admin" \
  --flatten="bindings[].members" \
  --format="table(bindings.members)"

# Enable the Security Command Center API
gcloud services enable securitycenter.googleapis.com \
  --project=my-project

# Activate SCC Premium (organization-level)
# This is typically done through the Console:
# Security > Security Command Center > Settings > Tier

# Enable all built-in services
gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=security-health-analytics

gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=event-threat-detection

gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=container-threat-detection

gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=web-security-scanner

gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=virtual-machine-threat-detection

# Verify all services are enabled
gcloud scc settings services describe \
  --organization=ORGANIZATION_ID \
  --service=security-health-analytics \
  --format="yaml(serviceEnablementState)"

# Grant the SCC service account access to scan resources
# (This is usually automatic, but verify if scans are not running)
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com" \
  --role="roles/cloudasset.viewer"

# List all active critical findings
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND severity="CRITICAL"' \
  --format="table(finding.category, finding.resourceName, finding.severity, finding.createTime)"

# List findings for a specific project
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND resource.projectDisplayName="prod-project"' \
  --format="table(finding.category, finding.severity)"

# Get detailed finding with remediation steps
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='finding.category="PUBLIC_BUCKET_ACL"' \
  --format=json

# Count findings by severity across the organization
gcloud scc findings group organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE"' \
  --group-by="severity"

# Count findings by category (find your biggest problem areas)
gcloud scc findings group organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND severity="HIGH"' \
  --group-by="category"

# Mute a finding (accepted risk with justification)
gcloud scc findings update FINDING_NAME \
  --source=SOURCE_ID \
  --organization=ORGANIZATION_ID \
  --mute=MUTED

# Create a mute rule for intentionally public resources
gcloud scc muteconfigs create public-website-bucket \
  --organization=ORGANIZATION_ID \
  --filter='category="PUBLIC_BUCKET_ACL" AND resource.name:"website-assets"' \
  --description="Website assets bucket is intentionally public"

# List all mute configurations (audit accepted risks)
gcloud scc muteconfigs list --organization=ORGANIZATION_ID

# List all active threat findings
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.findingClass="THREAT"' \
  --format="table(finding.category, finding.severity, finding.resourceName, finding.createTime)"

# Get detailed threat finding with indicators
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='finding.category="Malware: Cryptomining Bad Domain"' \
  --format=json

# List findings from Event Threat Detection specifically
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.sourceProperties.sourceId.projectDisplayName="Event Threat Detection"' \
  --format="table(finding.category, finding.severity, finding.resourceName)"

# Check for privilege escalation attempts in the last 24 hours
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.category="Persistence: IAM Anomalous Grant"' \
  --format=json

# Verify CTD is enabled for your organization
gcloud scc settings services describe \
  --organization=ORGANIZATION_ID \
  --service=container-threat-detection

# Check that CTD DaemonSet is running on your cluster
kubectl get ds -n kube-system | grep container-threat-detection

# List container-specific threat findings
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.category:"Container"' \
  --format="table(finding.category, finding.severity, finding.resourceName, finding.createTime)"

# Get detailed container threat finding
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='finding.category="Added Binary Executed"' \
  --format=json
# The finding includes: container name, pod name, namespace,
# binary path, binary hash, and parent process information

# Set up alert for container threats
gcloud scc notifications create container-threats \
  --organization=ORGANIZATION_ID \
  --pubsub-topic=projects/security-project/topics/scc-findings \
  --filter='state="ACTIVE" AND finding.category:"Container" AND severity="CRITICAL"'

# List attack path findings for high-value resources
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.findingClass="TOXIC_COMBINATION"' \
  --format="table(finding.category, finding.severity, finding.resourceName)"

# Get detailed attack exposure scores
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='finding.attackExposure.score > 0' \
  --format="table(finding.category, finding.attackExposure.score, finding.resourceName)" \
  --sort-by="~finding.attackExposure.score"

# The attack exposure score (0-10) indicates how accessible
# a resource is to an attacker. Higher scores = more exposure.
# Focus on findings with scores above 5 first.

# View which resources SCC considers high-value
gcloud scc custom-modules list \
  --organization=ORGANIZATION_ID

# List compliance findings mapped to CIS benchmarks
gcloud scc findings list organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.compliances.standard="cis-gcp-benchmark"' \
  --format="table(finding.category, finding.severity, finding.compliances)"

# Count non-compliant findings per CIS section
gcloud scc findings group organizations/ORGANIZATION_ID \
  --source=organizations/ORGANIZATION_ID/sources/- \
  --filter='state="ACTIVE" AND finding.compliances.standard="cis-gcp-benchmark"' \
  --group-by="finding.compliances.ids"

# Export compliance data to BigQuery for dashboarding
# First, create a BigQuery dataset
bq mk --dataset security_project:scc_compliance

# Create an export config
gcloud scc bqdatasets create scc-compliance-export \
  --organization=ORGANIZATION_ID \
  --dataset=projects/security-project/datasets/scc_compliance

# Query compliance trends in BigQuery
# SELECT
#   DATE(create_time) as date,
#   compliance_standard,
#   severity,
#   COUNT(*) as finding_count
# FROM security_project.scc_compliance.findings
# WHERE state = 'ACTIVE'
# GROUP BY date, compliance_standard, severity
# ORDER BY date DESC

# Create a Pub/Sub topic for SCC findings
gcloud pubsub topics create scc-findings-export \
  --project=security-project

# Create notification config for all critical/high findings
gcloud scc notifications create critical-findings \
  --organization=ORGANIZATION_ID \
  --pubsub-topic=projects/security-project/topics/scc-findings-export \
  --filter='state="ACTIVE" AND (severity="CRITICAL" OR severity="HIGH")'

# Create separate notification for threat findings (for immediate response)
gcloud scc notifications create threat-findings \
  --organization=ORGANIZATION_ID \
  --pubsub-topic=projects/security-project/topics/scc-threats \
  --filter='state="ACTIVE" AND finding.findingClass="THREAT"'

# Create notification for compliance violations
gcloud scc notifications create compliance-violations \
  --organization=ORGANIZATION_ID \
  --pubsub-topic=projects/security-project/topics/scc-compliance \
  --filter='state="ACTIVE" AND finding.compliances.standard:"cis-gcp-benchmark"'

# For Splunk integration: create a push subscription
gcloud pubsub subscriptions create scc-to-splunk \
  --topic=scc-findings-export \
  --push-endpoint="https://hec.splunk.example.com:8088/services/collector" \
  --push-auth-service-account=splunk-push@security-project.iam.gserviceaccount.com

# For Chronicle SIEM: use the built-in integration
# Navigate to SCC Settings > Integrations > Chronicle
# Chronicle provides native parsing, correlation, and investigation workflows

# For PagerDuty: route critical findings through Cloud Functions
gcloud pubsub subscriptions create scc-to-pagerduty \
  --topic=scc-threats \
  --push-endpoint="https://us-central1-security-project.cloudfunctions.net/scc-to-pagerduty"

# List all notification configs
gcloud scc notifications list --organization=ORGANIZATION_ID

# Enable continuous export to BigQuery
gcloud scc bqdatasets create scc-export \
  --organization=ORGANIZATION_ID \
  --dataset=projects/security-project/datasets/scc_findings

# Example BigQuery queries for security dashboards:

# 1. Finding trends over time (are we getting better or worse?)
# SELECT
#   DATE(create_time) as date,
#   severity,
#   COUNT(*) as new_findings,
#   SUM(CASE WHEN state = 'ACTIVE' THEN 1 ELSE 0 END) as still_active
# FROM security_project.scc_findings.findings
# WHERE create_time > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 90 DAY)
# GROUP BY date, severity
# ORDER BY date DESC

# 2. Mean time to remediate by severity
# SELECT
#   severity,
#   AVG(TIMESTAMP_DIFF(
#     COALESCE(state_change_time, CURRENT_TIMESTAMP()),
#     create_time, HOUR
#   )) as avg_hours_to_remediate,
#   COUNT(*) as total_findings
# FROM security_project.scc_findings.findings
# WHERE create_time > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 90 DAY)
# GROUP BY severity

# 3. Top 10 projects with the most findings
# SELECT
#   resource.project_display_name,
#   severity,
#   COUNT(*) as finding_count
# FROM security_project.scc_findings.findings
# WHERE state = 'ACTIVE'
# GROUP BY resource.project_display_name, severity
# ORDER BY finding_count DESC
# LIMIT 10

# 4. Finding categories that recur (process problems)
# SELECT
#   category,
#   COUNT(*) as occurrence_count,
#   COUNT(DISTINCT resource.project_display_name) as affected_projects
# FROM security_project.scc_findings.findings
# WHERE state = 'ACTIVE'
# GROUP BY category
# ORDER BY occurrence_count DESC

import functions_framework
import json
import logging
from google.cloud import storage
from google.cloud import compute_v1
from google.cloud import securitycenter

logger = logging.getLogger(__name__)

# Resources that are intentionally public (skip remediation)
ALLOWLISTED_BUCKETS = {
    "public-website-assets",
    "public-static-content",
}

ALLOWLISTED_PROJECTS = {
    "sandbox-project",  # Don't auto-remediate in sandbox
}


@functions_framework.cloud_event
def remediate_finding(cloud_event):
    """Automatically remediate common SCC findings."""
    pubsub_data = json.loads(
        cloud_event.data["message"]["data"]
    )

    finding = pubsub_data.get("finding", {})
    category = finding.get("category", "")
    resource_name = finding.get("resourceName", "")
    severity = finding.get("severity", "")
    project = finding.get("resource", {}).get(
        "projectDisplayName", ""
    )

    # Skip allowlisted projects
    if project in ALLOWLISTED_PROJECTS:
        logger.info(
            f"Skipping remediation for allowlisted project: {project}"
        )
        return

    logger.info(
        f"Processing finding: {category} "
        f"(severity: {severity}) "
        f"on resource: {resource_name}"
    )

    # Route to appropriate remediation handler
    handlers = {
        "PUBLIC_BUCKET_ACL": remediate_public_bucket,
        "OPEN_FIREWALL": remediate_open_firewall,
        "OPEN_SSH_PORT": remediate_open_ssh,
        "OPEN_RDP_PORT": remediate_open_rdp,
        "SQL_PUBLIC_IP": log_and_alert,
    }

    handler = handlers.get(category, log_unknown_finding)
    handler(finding, resource_name)


def remediate_public_bucket(finding, resource_name):
    """Remove public access from GCS buckets."""
    bucket_name = resource_name.split("/")[-1]

    if bucket_name in ALLOWLISTED_BUCKETS:
        logger.info(
            f"Bucket {bucket_name} is allowlisted, skipping"
        )
        return

    client = storage.Client()
    bucket = client.get_bucket(bucket_name)

    # Enable uniform bucket-level access
    bucket.iam_configuration.uniform_bucket_level_access_enabled = True
    bucket.patch()

    # Enforce public access prevention
    bucket.iam_configuration.public_access_prevention = "enforced"
    bucket.patch()

    logger.info(
        f"REMEDIATED: Removed public access from "
        f"bucket {bucket_name}"
    )


def remediate_open_firewall(finding, resource_name):
    """Disable overly permissive firewall rules."""
    # Extract project and firewall name from resource
    parts = resource_name.split("/")
    project_id = parts[4]  # projects/{project}
    firewall_name = parts[-1]

    client = compute_v1.FirewallsClient()
    firewall = client.get(
        project=project_id, firewall=firewall_name
    )

    # Disable the rule instead of deleting it
    # (preserves the rule for investigation)
    firewall.disabled = True
    operation = client.patch(
        project=project_id,
        firewall=firewall_name,
        firewall_resource=firewall,
    )
    operation.result()

    logger.info(
        f"REMEDIATED: Disabled open firewall rule "
        f"{firewall_name} in project {project_id}"
    )


def remediate_open_ssh(finding, resource_name):
    """Handle open SSH port findings."""
    logger.warning(
        f"ALERT: Open SSH port detected on "
        f"{resource_name}. "
        f"Disabling firewall rule."
    )
    remediate_open_firewall(finding, resource_name)


def remediate_open_rdp(finding, resource_name):
    """Handle open RDP port findings."""
    logger.warning(
        f"ALERT: Open RDP port detected on "
        f"{resource_name}. "
        f"Disabling firewall rule."
    )
    remediate_open_firewall(finding, resource_name)


def log_and_alert(finding, resource_name):
    """Log and alert for findings that need human review."""
    category = finding.get("category", "")
    severity = finding.get("severity", "")
    logger.warning(
        f"REQUIRES HUMAN REVIEW: {category} "
        f"(severity: {severity}) "
        f"on {resource_name}"
    )
    # In production: send to PagerDuty, Slack, or Jira


def log_unknown_finding(finding, resource_name):
    """Log findings without automated remediation."""
    category = finding.get("category", "")
    logger.info(
        f"No auto-remediation for: {category} "
        f"on {resource_name}"
    )

# Deploy the remediation Cloud Function
gcloud functions deploy scc-auto-remediate \
  --gen2 \
  --runtime=python312 \
  --region=us-central1 \
  --source=./remediation-function \
  --entry-point=remediate_finding \
  --trigger-topic=scc-findings-export \
  --service-account=scc-remediation@security-project.iam.gserviceaccount.com \
  --memory=256Mi \
  --timeout=120

# Grant the remediation SA the minimum required roles
# Storage admin for bucket remediation
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:scc-remediation@security-project.iam.gserviceaccount.com" \
  --role="roles/storage.admin" \
  --condition='expression=resource.type == "storage.googleapis.com/Bucket",title=storage-only'

# Compute security admin for firewall remediation
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:scc-remediation@security-project.iam.gserviceaccount.com" \
  --role="roles/compute.securityAdmin"

# SCC findings viewer for reading finding details
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:scc-remediation@security-project.iam.gserviceaccount.com" \
  --role="roles/securitycenter.findingsViewer"

# Create a scan configuration
gcloud beta web-security-scanner scan-configs create \
  --display-name="Production API Scan" \
  --starting-urls="https://api.example.com" \
  --project=prod-project

# List scan configs
gcloud beta web-security-scanner scan-configs list \
  --project=prod-project

# Start a scan
gcloud beta web-security-scanner scan-runs start \
  --scan-config=SCAN_CONFIG_ID \
  --project=prod-project

# Check scan status
gcloud beta web-security-scanner scan-runs list \
  --scan-config=SCAN_CONFIG_ID \
  --project=prod-project

# View scan findings
gcloud beta web-security-scanner scan-runs findings list \
  --scan-config=SCAN_CONFIG_ID \
  --scan-run=SCAN_RUN_ID \
  --project=prod-project

# Schedule regular scans (weekly recommended for production)
# Use Cloud Scheduler to trigger scans on a schedule
gcloud scheduler jobs create http weekly-security-scan \
  --schedule="0 3 * * 1" \
  --time-zone="UTC" \
  --uri="https://websecurityscanner.googleapis.com/v1/projects/prod-project/scanConfigs/SCAN_CONFIG_ID/scanRuns" \
  --http-method=POST \
  --oauth-service-account-email=scanner@prod-project.iam.gserviceaccount.com

# Configure SCC notification for critical findings
resource "google_scc_notification_config" "critical_findings" {
  config_id    = "critical-findings-notification"
  organization = "organizations/ORGANIZATION_ID"
  description  = "Notify on critical and high severity findings"
  pubsub_topic = google_pubsub_topic.scc_findings.id

  streaming_config {
    filter = "state = \"ACTIVE\" AND (severity = \"CRITICAL\" OR severity = \"HIGH\")"
  }
}

resource "google_scc_notification_config" "threat_findings" {
  config_id    = "threat-findings-notification"
  organization = "organizations/ORGANIZATION_ID"
  description  = "Notify on all active threat findings"
  pubsub_topic = google_pubsub_topic.scc_threats.id

  streaming_config {
    filter = "state = \"ACTIVE\" AND finding.findingClass = \"THREAT\""
  }
}

# Pub/Sub topics for SCC findings
resource "google_pubsub_topic" "scc_findings" {
  name    = "scc-findings"
  project = var.security_project_id

  message_retention_duration = "604800s"  # 7 days
}

resource "google_pubsub_topic" "scc_threats" {
  name    = "scc-threats"
  project = var.security_project_id

  message_retention_duration = "604800s"
}

# Subscription for the remediation function
resource "google_pubsub_subscription" "remediation" {
  name    = "scc-remediation"
  topic   = google_pubsub_topic.scc_findings.name
  project = var.security_project_id

  push_config {
    push_endpoint = google_cloudfunctions2_function.remediation.url
    oidc_token {
      service_account_email = google_service_account.remediation.email
    }
  }

  retry_policy {
    minimum_backoff = "10s"
    maximum_backoff = "600s"
  }

  dead_letter_policy {
    dead_letter_topic     = google_pubsub_topic.scc_dlq.id
    max_delivery_attempts = 5
  }
}

# Dead letter queue for failed remediations
resource "google_pubsub_topic" "scc_dlq" {
  name    = "scc-remediation-dlq"
  project = var.security_project_id
}

# Mute rules for accepted risks
resource "google_scc_mute_config" "public_website" {
  mute_config_id = "public-website-bucket"
  parent         = "organizations/ORGANIZATION_ID"
  description    = "Website assets bucket is intentionally public"
  filter         = "category = \"PUBLIC_BUCKET_ACL\" AND resource.name : \"website-assets\""
}

resource "google_scc_mute_config" "sandbox_findings" {
  mute_config_id = "sandbox-project-findings"
  parent         = "organizations/ORGANIZATION_ID"
  description    = "Sandbox project findings are reviewed but not actioned"
  filter         = "resource.projectDisplayName = \"sandbox-project\" AND severity != \"CRITICAL\""
}

# BigQuery export for long-term analysis
resource "google_bigquery_dataset" "scc_findings" {
  dataset_id = "scc_findings"
  project    = var.security_project_id
  location   = "US"

  default_table_expiration_ms = null  # No expiration

  access {
    role          = "OWNER"
    special_group = "projectOwners"
  }

  access {
    role           = "WRITER"
    user_by_email  = "scc-export@${var.security_project_id}.iam.gserviceaccount.com"
  }
}

# Service account for remediation
resource "google_service_account" "remediation" {
  account_id   = "scc-remediation"
  display_name = "SCC Auto-Remediation"
  project      = var.security_project_id
}

# Minimum required roles for the remediation SA
resource "google_organization_iam_member" "remediation_storage" {
  org_id = var.organization_id
  role   = "roles/storage.admin"
  member = "serviceAccount:${google_service_account.remediation.email}"
}

resource "google_organization_iam_member" "remediation_compute" {
  org_id = var.organization_id
  role   = "roles/compute.securityAdmin"
  member = "serviceAccount:${google_service_account.remediation.email}"
}

resource "google_organization_iam_member" "remediation_scc" {
  org_id = var.organization_id
  role   = "roles/securitycenter.findingsViewer"
  member = "serviceAccount:${google_service_account.remediation.email}"
}