Vendors / Google Cloud Platform / Security Command Center / SCC Chokepoint Findings

Event type

SCC Chokepoint Findings

Critical attack path convergence points

Chokepoint findings from Google Cloud Security Command Center Security Graph, identifying resources or resource groups where high-risk attack paths converge based on attack path simulations.

JSON 7 fields Low Generator

chokepoint attack-path risk-assessment security-graph gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Chokepoint findings identify a resource or resource group where high-risk attack paths converge, based on attack path simulations. Remediating a chokepoint finding might remediate multiple toxic combinations.

When generated

›Single network path provides access to multiple high-value resources
›Service account acts as gateway to multiple sensitive data sources
›Firewall rule creates single point of access for critical systems
›IAM role grants access to multiple critical resources through one principal
›Load balancer routes traffic to all backend services without segmentation

Security relevance

Critical

Compliance

NIST 800-53 (SC-7, AC-3) ISO 27001 (A.13.1.1, A.9.1.2) CIS GCP Foundation 2.0 SOC 2 (CC6.1)

Frequency notes

Chokepoint findings are generated by Security Graph analysis when attack path simulations identify convergence points. These are rare but critical findings that represent single points of failure in security architecture. Remediating chokepoints can eliminate multiple attack paths simultaneously.

Resources

Docs and tools

Finding Classes - Chokepoint official Toxic Combinations and Chokepoints Overview official Security Graph official

Generation

Configuration

Base frequency: 3 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.1x
Night hours: 0.95x
Weekend: 0.8x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the chokepoint finding

Source: Constructed with 'chokepoint-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/chokepoint-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/chokepoint-abc123...

category

String Required

Chokepoint category

Example NETWORK_CHOKEPOINT

Values

NETWORK_CHOKEPOINT Network resource creates chokepoint
IAM_CHOKEPOINT IAM resource creates chokepoint
DATA_ACCESS_CHOKEPOINT Data access resource creates chokepoint
SERVICE_CHOKEPOINT Service resource creates chokepoint

sourceProperties.chokepoint

Object Required

Chokepoint details

Source: Object with description, chokepointType, criticality, affectedResources, attackExposureScore, and remediationGuidance

sourceProperties.chokepoint.affectedResources

Array Required

Array of high-value resources accessible through the chokepoint

Source: Array of resource objects with resourceName, resourceType, and sensitivity

sourceProperties.chokepoint.attackExposureScore

Integer Required

Attack exposure score (0-10)

Source: random_choice([8, 9, 10])

Example 10

severity

String Required

Chokepoint severity level

Source: random_weighted favoring CRITICAL (60%)

Example CRITICAL

Values

CRITICAL Critical chokepoint
HIGH High severity chokepoint
MEDIUM Medium severity chokepoint

findingClass

String Required

Finding class identifier

Source: Static 'CHOKEPOINT'

Example CHOKEPOINT