Work with findings in the console

This page explains how to work with Security Command Center findings in the Google Cloud console and the Security Operations console.

A finding is a record of a security issue that the Security Command Center services create when they detect a security issue. Findings are listed in the Findings page. You can click a finding to see its details and full JSON format.

Some of the actions that you can perform on the Findings page include the following:

• Query findings
• Inspect findings
• Mute findings
• Add security marks to findings

For information about working with findings by using the Security Command Center API, see Accessing Security Command Center programmatically.

Working with findings in the Security Command Center Enterprise consoles

If you are a Security Command Center Enterprise customer, you can work with findings in two consoles:

• Google Cloud console: available in all service tiers
• Security Operations console: available in the Enterprise tier only

The Findings page in the Security Operations console is in Preview.

On this page, the steps for working with the two consoles are described side-by-side on separate tabs.

For more information, see Security Command Center Enterprise consoles.

Obtain the required permissions

This section lists the IAM roles that you need to work with findings in the console.

Google Cloud console IAM roles

To work with findings in the Google Cloud console, you need the following IAM roles.

Make sure that you have the following role or roles on the organization:

• Security Center Findings Viewer (roles/securitycenter.findingsViewer)
• Security Center Findings Editor (roles/securitycenter.findingsEditor)

For more information about Security Command Center roles and permissions, see IAM for organization-level activations.

Security Operations console IAM roles

If you are a Security Command Center Enterprise customer, you can work with findings in the Security Operations console. You need any of the following IAM roles:

• Chronicle SOAR Admin (roles/chronicle.soarAdmin)
• Chronicle SOAR Threat Manager (roles/chronicle.soarThreatManager)
• Chronicle SOAR Vulnerability Manager (roles/chronicle.soarVulnerabilityManager)

For information about granting the role to a user, see Map and authorize users using IAM.

View findings

For information about locating the Findings page, click the tab for the console that you are using.

https://CUSTOMER_SUBDOMAIN.backstory.chronicle.security/posture/findings

Adjust the time range to view more findings

You can adjust the time range that is used for your queries. The default time range is Last 7 days.

The time range is based on the value of the eventTime attribute of the findings, which reflects the time at which the finding record was last updated.

For information about how to adjust the time range, click the tab for the console that you are using.

Finding availability

A finding usually becomes available for you to query in Security Command Center less than a minute after the service that generates the finding stores it in the Security Command Center findings database. Premium and Enterprise tier findings remain available for querying for at least 13 months. Standard tier findings remain available for at least 35 days.

Security Command Center stores one or more snapshots of each finding. A snapshot of a Premium or Enterprise tier finding is deleted 13 months after the timestamp in the eventTime field. If all snapshots for a finding are deleted, the finding can no longer be queried or recovered.

For more information about Security Command Center data retention, see Data retention.

Find and view specific findings

By default, the Findings page displays all active findings that are not muted and that are either new or updated over the last seven days.

To see specific findings, edit the findings query to specify the values or attributes that the findings you need to see must or must not contain.

The following example is the default findings query:

state="ACTIVE"
AND NOT mute="MUTED"

You can see the current findings query in the Query editor panel. You can edit the query directly or select predefined filters to build the query. For more information, click the tab for the console that you are using.

View the details of a finding

To learn more about a finding, open the detailed view of the finding by clicking the finding name in the Category column in the findings query results.

In the detail view, you can find information that is critical for understanding a finding, investigating a threat, or addressing a vulnerability.

The detail view for findings includes the following tabs that you can select to learn more about a finding and take action:

• The Summary tab, which is the default view, highlights key information and attributes about the finding.
• The Source properties tab, where you can see the attributes of the sourceProperties object of the finding JSON.
• The JSON tab, where you can see the full JSON format of the finding.

You can take certain actions on the finding in the detail view, as well as find links to additional information that is related to the finding.

Learn about the finding in the detail view

The detail view of a finding highlights important information about the finding that you can use to understand and address the underlying security issue.

Information on the Summary tab

The Summary tab provides information about the finding in the following sections:

What was detected (or Overview)

Details about the finding that was detected, such as the following:

• The finding severity
• The finding state, ACTIVE or INACTIVE
• Any key fields that are related to the specific finding

Vulnerability

Information from the CVE record that corresponds to the vulnerability, if any. The Vulnerability section includes information from the CVE record, such as:

• CVE ID
• CVE score
• Impact
• Exploitation activity

Attack exposure

The attack exposure score and the time at which the score was last calculated. Clicking the score opens a visual depiction of the affected high-value resources and the associated attack path.

Affected resource

Details about the resource that is associated with the finding, including the following information:

• The full name of the affected resource
• The cloud service provider of the resource
• The technical and security contacts

Case information

Details about the case that is associated with the finding, including the following information.

• The full resource name of the external system that is associated with the finding
• The group assigned to the case
• The case ID, which links to the case in the Security Operations console
• The status of the case
• The update time in the external case management system
• The committed deadline for closing the case

Security marks

The security marks that are associated with this finding, if any.

Next steps

Guidance on what you can do to remediate the issue detected. Only certain services, such as Security Health Analytics, provide next steps.

Related links

Links to key sources of security information outside of Security Command Center. Only certain services, such as Event Threat Detection, provide related links.

Detection service

Details about the service, or source, that detected the finding.

Information on the Source properties tab

For some findings, the details panel includes a Source properties tab that highlights certain properties from the sourceProperties object of the finding JSON.

Source properties differ for each finding and for each service that runs on Security Command Center. There's no assurance that source properties are standardized across all services. For this reason, we strongly discourage consuming source properties programmatically. If you want a source property to be standardized across all services, let us know by sending your feedback.

Information on the JSON tab

The JSON tab contains the complete JSON structure of the finding, which can be useful when you're investigating a finding or looking up attributes that you can use in your findings queries.

To copy the JSON object to your clipboard, click content_copy Copy.

The JSON structure of a finding contains the following objects:

• findings: The finding's attributes. These attributes are standardized across all built-in and integrated services (also known as security sources). For more information, see Finding.
• resource: The attributes of the affected resource. For more information, see Resource.
• sourceProperties: The service-specific properties of the finding.

You can also use the ListFindings API to list findings and get their JSON definitions.

Take action on a finding from the detail view

You can take a variety of actions on a finding from the finding's detail view, such as mute the finding. If you are viewing the finding's detail view in the Google Cloud console, you can also add attributes from the finding to the current findings query.

Mute a finding in the detail view

From the detail view of a finding, you can mute or unmute the finding. You can also create a rule that mutes all future findings like the current finding.

For complete instructions for muting a finding or creating a mute rule, see Mute findings in Security Command Center.

Add attribute filters to a query from the detail view

In the Google Cloud console, in the detail view of a finding, you can add filters for the displayed attributes to the current findings query.

For information about how to add attribute filters to a query from the detail view, click the tab for the console that you are using.

View or copy attribute API names in the detail view of a finding

Most finding attributes that are displayed in the Google Cloud console have a corresponding name that is used in the Security Command Center API.

For information about how to view or copy attribute API names in the detail view of a finding, click the tab for the console that you are using.

Google Cloud console

1. On the Findings page, click the finding to view its details.
2. In the detail view of the finding, you can find and copy the corresponding API name of each displayed finding attribute.

Security Operations console

1. On the Findings page, click the finding to view its details.
2. In the detail view of the finding, find the attribute whose API equivalent you want to copy.
3. Next to the attribute, open the drop-down menu.
4. Click Copy API Equivalent.

This feature is in Preview and is available to Security Command Center Enterprise customers only.

Share the detail view of a finding

To share the detail view of a finding, you can copy the URL of the detail view page for sharing with others.

For information about how to copy the URL of the detail view of a finding, click the tab for the console that you are using.

Send feedback about the finding to Google Cloud

For information about how to send feedback about a finding, click the tab for the console that you are using.

Display details of other findings in the findings query results

To see the details of the findings that precede or follow the finding that you are viewing, use the navigate_next next or navigate_before previous button to go to the next or previous finding, without having to go back to the Findings page.

Add security marks to findings

A security mark is a custom key-value label that you can use to annotate a finding, associate a finding with other findings that share the same security mark, and query findings.

For complete instructions for setting security marks on findings or assets, see Using security marks.

Mute findings in the console

You can mute and unmute findings from the following views:

• Findings query results on the Findings page
• Detail view of a finding

You can mute individual findings or create mute rules that mute current and future findings based on filters you define.

Muted findings are hidden and silenced, but you can still view them by adding the mute="MUTED" filter to your findings query. Muted findings continue to be logged for audit and compliance purposes.

For detailed instructions on how to mute and unmute findings, see Mute findings in Security Command Center.

Change the state of a finding

A finding can have one of two states: Active or Inactive.

A state of Active means that the security issue that is identified by the finding persists in your environment as a potential threat or vulnerability.

A state of Inactive means that the security issue has been addressed.

You might want to change the state of a finding for a variety of reasons, such as to change the state of a finding to Inactive as soon as it is addressed, so you don't have to wait for the next scan to change the state for you.

For information about how to change the state of a finding, click the tab for the console that you are using.

Customize the Findings page

To control screen space, you can customize some of the elements that appear on the findings query results.

Adjust columns of query results

You can add or remove columns from the findings query results.

You can remove any column except for Category.

The following are examples of columns that are available:

• Category: the name of the finding type.
• Severity: the severity of the finding. For more information about finding severity levels, see Severity classifications for findings.
• Attack exposure score: The attack exposure score of the finding.
• Event time: either when the finding was first detected or when it was last updated.
• Create time: when the finding was created in Security Command Center.
• Finding class: the class of the finding, such as THREAT, VULNERABILITY, and MISCONFIGURATION.
• Resource display name: the display name of the resource in which the issue was detected.
• Resource full name: the full name of the resource in which the issue was detected.
• Resource cloud provider: The cloud service provider on which the resource is hosted.
• Resource path: the path to the resource in which the issue was detected.
• Resource type: the type of resource in which the issue was detected.
• Security marks: Any security marks that are added to the finding.

For information about how to adjust the columns of the findings query results, click the tab for the console that you are using.

Hide or display Finding page panels

For information about how to adjust the Findings page panels, click the tab for the console that you are using.

What's next

• Learn about detection services.
• Learn how to use security marks.
• Learn how to configure Security Command Center services.
• Learn how to form a findings filter using the Security Command Center API.