Build Security Command Center finding filter configurations with severity, category, and indicators.
Last verified: May 2026
Build Security Command Center finding filter configurations with severity, category, and indicator details.
Required Fields
parentfindingIdfinding.statefinding.categoryfinding.severityfinding.resourceNameOutput will appear here...Your security team has 5,000+ open findings in SCC across the organization — most are noise. The builder generates targeted filters: 'CRITICAL severity AND state=ACTIVE AND age >24h AND production folders only' = 12 actionable findings. Saved as a dashboard, the security team focuses on these instead of drowning in the full list. Mean-time-to-resolution drops dramatically because attention is on real high-priority issues.
Build Security Command Center finding filter configurations with severity, category, and indicators. This tool helps GCP engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.
The builder constructs SCC finding filter expressions for use in queries, alert rules, and saved dashboards. Filters use SCC's filter syntax matching: severity (CRITICAL/HIGH/MEDIUM/LOW), category (e.g., MISCONFIGURATION, VULNERABILITY, MALWARE), state (ACTIVE/INACTIVE/MUTED), resource type, time ranges, and custom indicators. Output is the filter expression usable in `gcloud scc findings list` and Terraform google_scc_notification_config resources.
SCC Premium tier costs ~$0.65/asset/month and includes Event Threat Detection, Container Threat Detection, and Web Security Scanner — substantially more than Standard tier (free, basic vulnerability findings only). For organizations subject to SOC 2 / PCI / HIPAA, Premium pays for itself.
Filter findings aggressively in dashboards. Default views show every finding which causes alert fatigue. Build saved filters for: 'critical findings unresolved >7 days' (high priority), 'high-severity production-only', 'compliance-relevant only'. Each team sees their relevant subset.
Mute irrelevant findings instead of leaving them open. SCC's mute feature is the right way to handle 'this finding doesn't apply to us' (e.g., 'public bucket' findings on intentionally-public CDN buckets). Muting documents the decision for audit; ignoring the finding leaves it forever in 'open' state.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.