category: Data Enrichment & Threat Intelligence sectionorder: - Connect - Collect provider: Google commonfields: id: GoogleCloudSCC version: -1 configuration: - additionalinfo: If the application runs on cloud provider (AWS, Azure) use workload identity federation configuration setup file otherwise use service account credential file. display: Service Account Configuration name: service_account_json required: true type: 4 section: Connect - additionalinfo: Organization ID defines from which organization incidents need to be fetched. display: Organization ID name: organization_id required: true type: 0 section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - additionalinfo: |- ID of the project to use for fetching incidents. If ID is not provided it will be taken from the provided service account JSON. Only required if the XSOAR instance is running on AWS or Azure cloud solutions. display: Project ID name: project_id type: 0 required: false section: Connect - additionalinfo: ID of subscription from which to fetch incidents. display: Subscription ID name: subscription_id type: 0 required: false section: Connect - additionalinfo: The maximum number of incidents to fetch every time. defaultvalue: '50' display: Max Incidents name: max_fetch type: 0 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - additionalinfo: Enables to trust on all certificates display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - additionalinfo: Enables system proxy settings display: Use system proxy settings name: proxy type: 8 required: false section: Connect description: Security Command Center is a security and risk management platform for Google Cloud. Security Command Center enables you to understand your security and data attack surface by providing asset inventory and discovery, identifying vulnerabilities and threats, and helping you mitigate and remediate risks across an organization. This integration helps you to perform tasks related to findings and assets. display: Google Cloud SCC name: GoogleCloudSCC script: commands: - arguments: - description: |- The filter expression is a list of one or more restrictions combined via logical operators AND and OR. Parentheses are supported, and OR has higher precedence than AND.Examples include: 1) name 2) securityCenterProperties.resource_name 3) resourceProperties.name 4) securityMarks.marks.marka The supported operators are: 1) = for all value types. 2) >, <, >=, <= for integer values. 3) :, meaning substring matching, for strings. The following field and operator combinations are supported: 1) name: = 2) updateTime: =, >, <, >=, < Example: resourceProperties.displayName="test.com" OR resourceProperties.projectNumber="455757558851" Use a negated partial match on the empty string to filter based on a property not existing: "-resourceProperties.project=45". name: filter - description: |- This parameter defines what fields and order to use for sorting. The string value should be a comma-separated list of fields. The default sorting order is ascending. To specify descending order for a field, a suffix "desc" should be appended to the field name. For example: "name desc,resourceProperties.owner". The following fields are supported for orderBy: name, updateTime, resourceProperties, securityMarks.marks, securityCenterProperties.resource_name, securityCenterProperties.resource_display_name, securityCenterProperties.resource_parent, securityCenterProperties.resource_parent_display_name, securityCenterProperties.resource_project, securityCenterProperties.resource_project_display_name, securityCenterProperties.resource_type. name: orderBy - description: |- Time is used as a reference point when filtering assets. The filter is limited to assets existing at the supplied time and their values are those at that specific time. If not provided, it will take current time. Format: YYYY-MM-ddTHH:mm:ss.sssZ Example: 2020-07-22T07:10:02.782Z. name: readTime - description: "When compareDuration is set, the \"stateChange\" attribute is updated to indicate whether the asset was added, removed, or remained present during the compareDuration period of time that precedes the readTime. \nPossible \"stateChange\" values when compareDuration is specified:\n1) ADDED\n2) REMOVED\n3) ACTIVE\n\nIf compareDuration is not specified, then the only possible stateChange is \"UNUSED\", \nExample value: 3.5s." name: compareDuration - description: |- A field mask is used to specify the specific response fields to be listed in the response. An empty field mask will list all fields. Comma-separated values are supported in this parameter. Example: "asset.resourceProperties.owner,asset.securityCenterProperties.resourceName". name: fieldMask - description: The value returned by the last response of the google-cloud-scc-asset-list command indicates that this is a continuation of prior assets.list call, and that the system should return the next page of data. name: pageToken - defaultValue: '10' description: The maximum number of results to return in a single response. The minimum value is 1 and maximum value is 1000. name: pageSize - description: ' This parameter is used to filter assets by resource types by providing a single value or a comma-separated value of resource types. If any resource type is not provided, by default all resource types will be considered for listing assets.The value provided inside resourceType would be applied in the query as a filter parameter for filtering results. Example: cloudfunction, bucket.' name: resourceType - description: 'This parameter is used to filter assets by the project by providing a single value or a comma-separated value of projects. If any project is not provided, by default all projects will be considered for listing assets. Value provided inside the project would be applied in the query as a filter parameter for filtering results. Example: Automeet, Backstory.' name: project - auto: PREDEFINED defaultValue: 'False' description: This parameter is used to filter assets by their lifeCycleState value by selecting an option from the dropdown. If 'True' is selected the assets having lifeCycleState as 'ACTIVE' will be fetched and if 'False' or no option selected from the dropdown, then assets with all states will be considered for listing assets. The value selected in activeAssetsOnly would be applied in the query as a filter parameter for filtering results. name: activeAssetsOnly predefined: - 'True' - 'False' deprecated: true description: Lists an organization's assets. name: google-cloud-scc-asset-list outputs: - contextPath: GoogleCloudSCC.Asset.name description: The relative resource name of the asset. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceName description: The full resource name of the Google Cloud resource this asset represents. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceType description: The type of the Google Cloud resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceParent description: The full resource name of the immediate parent of the resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceProject description: The full resource name of the project the resource belongs to. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceOwners description: Owners of the Google Cloud resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceDisplayName description: The user defined display name for this resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceParentDisplayName description: The user defined display name for the parent of this resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.resourceProjectDisplayName description: The user defined display name for the project of this resource. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.folders.resourceFolder description: Full resource name of this folder. type: String - contextPath: GoogleCloudSCC.Asset.securityCenterProperties.folders.resourceFolderDisplayName description: The user defined display name for this folder. type: String - contextPath: GoogleCloudSCC.Asset.resourceProperties description: Resource managed properties. These properties are managed and defined by the Google Cloud resource and cannot be modified by the user. Properties are varying from assets to assets. type: Unknown - contextPath: GoogleCloudSCC.Asset.securityMarks.name description: The relative resource name of the SecurityMarks. type: String - contextPath: GoogleCloudSCC.Asset.securityMarks.marks description: Mutable user specified security marks belonging to the parent resource. type: String - contextPath: GoogleCloudSCC.Asset.createTime description: The time at which the asset was created in the Security Command Center. type: String - contextPath: GoogleCloudSCC.Asset.updateTime description: The time at which the asset was last updated, added, or deleted in Security Command Center. type: String - contextPath: GoogleCloudSCC.Asset.iamPolicy.policyBlob description: Cloud IAM Policy information associated with the Google Cloud resource described by the Security Command Center asset. type: String - contextPath: GoogleCloudSCC.Asset.stateChange description: State change of the asset between the points in time. type: String - contextPath: GoogleCloudSCC.Asset.readTime description: Time used for executing the list request. type: String - contextPath: GoogleCloudSCC.Token.nextPageToken description: Token to retrieve the next page of results, or empty if there are no more results. type: String - contextPath: GoogleCloudSCC.Token.name description: Name of the command. type: String - arguments: - description: Filter findings by their severity (LOW, MEDIUM, HIGH, CRITICAL). Comma-separated values are supported and if any severity value is not provided, by default all the severities will be considered for listing of findings. Value provided inside severity would be applied in the query as a filter parameter for filtering results. name: severity - description: |- Filter findings by providing comma-separated values of categories or a single category. If any category value is not provided, by default all the categories will be considered for listing findings. Value provided inside the category would be applied in the query as a filter parameter for filtering results. For Example: anomaly,application. name: category - defaultValue: '-' description: Filter findings by providing the value of a single source type. If any source type Id value is not provided, by default all source types will be considered for list findings. name: sourceTypeId - defaultValue: '10' description: The maximum number of results to return in a single response. The minimum value is 1 and maximum value is 1000. name: pageSize - defaultValue: ACTIVE description: Filter the findings by their state. Can be 'ACTIVE', 'INACTIVE'. Comma-separated values are supported and if any state value is not provided, by default 'ACTIVE' state will be considered for listing of findings. Value provided inside the state would be applied in the query as a filter parameter for filtering results. name: state - description: | The filter expression is a list of one or more restrictions combined via logical operators AND and OR. Parentheses are supported, and OR has higher precedence than AND.Examples include: 1) name 2) sourceProperties.a_property 3) securityMarks.marks.marka The supported operators are: 1) = for all value types. 2) >, <, >=, <= for integer values. 3) :, meaning substring matching, for strings. The following field and operator combinations are supported: 1) name: = 2) parent: =, : 3) resourceName: =, : 4) state: =, : 5) category: =, : 6) externalUri: =, : 7) eventTime: =, >, <, >=, <= 8) severity: =, : 9) findingClass: = Examples: "sourceProperties.browser="chrome" AND sourceProperties.event_type="proximity"" Use a negated partial match on the empty string to filter based on a property not existing: "-severity=LOW". name: filter - description: |- This parameter defines what fields and order to use for sorting. The string value should be a comma separated list of fields. The default sorting order is ascending. To specify descending order for a field, a suffix " desc" should be appended to the field name. For example: "name desc,sourceProperties.browser". Supported fields: name, parent, state, category, resourceName, eventTime, sourceProperties, securityMarks.marks. name: orderBy - description: |- When compareDuration is set, the "stateChange" attribute is updated to indicate whether the finding had its state changed, the finding's state remained unchanged, or if the finding was added in any state during the compareDuration period of time that precedes the readTime. This is the time between (readTime - compareDuration) and readTime. The results aren't affected if the finding is made inactive and then active again. Possible "stateChange" values when compareDuration is specified: 1) CHANGED 2) UNCHANGED 3) ADDED 4) REMOVED If compareDuration is not specified, then the only possible stateChange is "UNUSED". Example value: "3.5s". name: compareDuration - description: "Time used as a reference point when filtering findings. The filter is limited to findings existing at the supplied time and their values are those at that specific time. If not provided, it will take current time. \nFormat: YYYY-MM-ddTHH:mm:ss.sssZ\nExample: 2020-07-22T07:10:02.782Z." name: readTime - description: |- A field mask is used to specify the specific response fields to be listed in the response. An empty field mask will list all fields. Comma-separated values are supported in this parameter. Example: "user.displayName,sourceProperties.browser". name: fieldMask - description: The value returned by the last response of a google-cloud-scc-finding-list command indicates that this is a continuation of a prior findings.list call, and that the system should return the next page of data. name: pageToken description: Lists an organization or source's findings. name: google-cloud-scc-finding-list outputs: - contextPath: GoogleCloudSCC.Finding.name description: The relative resource name of this finding. type: String - contextPath: GoogleCloudSCC.Finding.parent description: The relative resource name of the source the finding belongs to. type: String - contextPath: GoogleCloudSCC.Finding.resourceName description: For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. type: String - contextPath: GoogleCloudSCC.Finding.state description: The state of the finding. type: String - contextPath: GoogleCloudSCC.Finding.category description: The additional taxonomy group within findings from a given source. type: String - contextPath: GoogleCloudSCC.Finding.externalUri description: The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. type: String - contextPath: GoogleCloudSCC.Finding.createTime description: The time at which the finding was created in Security Command Center. type: String - contextPath: GoogleCloudSCC.Finding.eventTime description: The time at which the event took place, or when an update to the finding occurred. type: String - contextPath: GoogleCloudSCC.Finding.resource.name description: The full resource name of the resource. type: String - contextPath: GoogleCloudSCC.Finding.resource.parentDisplayName description: The human readable name of resource's parent. type: String - contextPath: GoogleCloudSCC.Finding.resource.parentName description: The full resource name of resource's parent. type: String - contextPath: GoogleCloudSCC.Finding.resource.projectDisplayName description: The human readable name of project that the resource belongs to. type: String - contextPath: GoogleCloudSCC.Finding.resource.projectName description: The full resource name of the project that the resource belongs to. type: String - contextPath: GoogleCloudSCC.Finding.resource.folders.resourceFolder description: Full resource name of this folder. type: String - contextPath: GoogleCloudSCC.Finding.resource.folders.resourceFolderDisplayName description: The user defined display name for this folder. type: String - contextPath: GoogleCloudSCC.Finding.stateChange description: State change of the finding between the points in time. type: String - contextPath: GoogleCloudSCC.Finding.sourceProperties description: Source specific properties. These properties are managed by the source that writes the finding. Properties are varying from finding to finding. type: Unknown - contextPath: GoogleCloudSCC.Finding.severity description: Severity of the finding. type: String - contextPath: GoogleCloudSCC.Finding.securityMarks.name description: The relative resource name of the SecurityMarks. type: String - contextPath: GoogleCloudSCC.Finding.securityMarks.marks description: Mutable user specified security marks belonging to the parent resource. type: String - contextPath: GoogleCloudSCC.Finding.readTime description: Time used for executing the list request. type: String - contextPath: GoogleCloudSCC.Token.nextPageToken description: Token to retrieve the next page of results, or empty if there are no more results. type: String - contextPath: GoogleCloudSCC.Token.name description: Name of the command. type: String - arguments: - description: |- The relative resource name of the finding. Format: organizations/{organization_id}/sources/{source_id}/finding/{findingId} Example: organizations/595779152576/sources/14801394649435054450/findings/bc5a86da657611ebb979005056a5924e. name: name required: true - description: |- Time at which the event took place. By default UTC current time will be taken if no value is provided in eventTime. Format: YYYY-MM-ddTHH:mm:ss.sssZ Example: 2020-07-22T07:10:02.782Z, 2014-10-02T15:01:23.045123456Z. name: eventTime - auto: PREDEFINED description: Related severity of the finding. name: severity predefined: - LOW - MEDIUM - HIGH - CRITICAL - description: URI that points to a web page outside of Cloud SCC (Security Command Center) where additional information about the finding can be found. name: externalUri - description: Source specific properties. These properties are managed by the source that writes the finding. For example "key1=val1,key2=val2". name: sourceProperties - description: A updateMask argument supports single or comma-separated fields that need to be updated/deleted. A updateMask is automatically generated in the backend for the specific arguments provided in the command and only those values will be updated. To delete attributes/properties, add those keys in updateMask without specifying those fields individually in the command arguments. name: updateMask description: Update an organization's or source's finding. name: google-cloud-scc-finding-update outputs: - contextPath: GoogleCloudSCC.Finding.name description: The relative resource name of this finding. type: String - contextPath: GoogleCloudSCC.Finding.parent description: The relative resource name of the source the finding belongs to. type: String - contextPath: GoogleCloudSCC.Finding.resourceName description: For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. type: String - contextPath: GoogleCloudSCC.Finding.state description: The state of the finding. type: String - contextPath: GoogleCloudSCC.Finding.category description: The additional taxonomy group within findings from a given source. type: String - contextPath: GoogleCloudSCC.Finding.externalUri description: The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. type: String - contextPath: GoogleCloudSCC.Finding.createTime description: The time at which the finding was created in Security Command Center. type: String - contextPath: GoogleCloudSCC.Finding.eventTime description: The time at which the event took place, or when an update to the finding occurred. type: String - contextPath: GoogleCloudSCC.Finding.sourceProperties description: Source specific properties. These properties are managed by the source that writes the finding. Properties are varying from finding to finding. type: Unknown - contextPath: GoogleCloudSCC.Finding.severity description: Severity of the finding. type: String - contextPath: GoogleCloudSCC.Finding.securityMarks.name description: The relative resource name of the SecurityMarks. type: String - contextPath: GoogleCloudSCC.Finding.securityMarks.marks description: Mutable user specified security marks belonging to the parent resource. type: String - arguments: - description: |- Name of the organization or project the assets belong to. Organization Id provided in the Integration Configuration will be taken by default, if no value is provided to the parent. Format: "organizations/[organization-number]" (such as "organizations/123"), "projects/[project-id]" (such as "projects/my-project-id"), or "projects/[project-number]" (such as "projects/12345"). name: parent - description: "This parameter is used to filter assets by asset types by providing a single value or a comma-separated value of asset types.\nFor example: \"compute.googleapis.com/Disk\".\n\nRegular expression is also supported. \nFor example:\n1) \"compute.googleapis.com.*\" resources whose asset type starts with \"compute.googleapis.com\".\n2) \".*Instance\" resources whose asset type ends with \"Instance\".\n3) \".*Instance.*\" resources whose asset type contains \"Instance\"." name: assetTypes - defaultValue: '10' description: The maximum number of results to return in a single response. The minimum value is 1 and maximum value is 1000. name: pageSize - description: The nextPageToken returned from the previous scc-asset-resource-list command response, or unspecified for the first scc-asset-resource-list command. It is a continuation of a prior scc-asset-resource-list call, and the API should return the next page of assets. name: pageToken - description: "Time used as a reference point when filtering assets. This can only be set to a timestamp between the current time and the current time minus 35 days (inclusive). If not provided, it will take current time. \n\nFormat:\n(