Vendors / Google Cloud Platform / Security Command Center / SCC Misconfiguration Findings

Event type

SCC Misconfiguration Findings

Security configuration issues

Misconfiguration findings from Google Cloud Security Command Center Security Health Analytics, identifying incorrect or suboptimal configurations of GCP resources that create security vulnerabilities.

JSON 8 fields Medium Generator

misconfiguration compliance security-posture configuration gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Misconfiguration findings identify vulnerabilities caused by incorrect or suboptimal configuration of GCP resources. These findings can typically be fixed by updating the resource configuration to follow security best practices.

When generated

›Cloud Storage buckets have public access enabled
›Service accounts have overly permissive IAM roles
›Firewall rules allow unrestricted access (0.0.0.0/0)
›Compute instances use legacy networks
›SSL/TLS policies use weak ciphers
›Audit logging is disabled for critical services
›Resources have public IP addresses unnecessarily

Security relevance

High

Compliance

CIS GCP Foundation 2.0 NIST 800-53 (CM-6, AC-3) ISO 27001 (A.9.1.2) PCI-DSS (1.2, 2.1) SOC 2 (CC6.1)

Frequency notes

Misconfiguration findings are generated during continuous security posture assessments. Frequency increases during business hours when resources are actively being created or modified. Findings may reactivate if configurations are reverted to insecure states.

Resources

Docs and tools

Security Health Analytics official Vulnerability Findings (includes misconfigurations) official Remediate Configuration Error Findings official

Generation

Configuration

Base frequency: 25 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.4x
Night hours: 0.9x
Weekend: 0.6x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the misconfiguration finding

Source: Constructed with 'misconfig-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/misconfig-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/misconfig-abc123...

category

String Required

Misconfiguration category

Example PUBLIC_BUCKET_ACL

Values

PUBLIC_BUCKET_ACL Cloud Storage bucket with public access
ADMIN_SERVICE_ACCOUNT Service account with admin privileges
OPEN_FIREWALL Firewall rule allowing unrestricted access
OPEN_SSH_PORT SSH port open to public internet
LEGACY_NETWORK Resource using legacy network
WEAK_SSL_POLICY Weak SSL/TLS cipher configuration
PUBLIC_IP_ADDRESS Unnecessary public IP address
LOGGING_DISABLED Audit logging disabled

sourceProperties.Recommendation

String Required

Remediation recommendation for the misconfiguration

Source: Context-specific recommendation based on category

Example Remove public access from Cloud Storage bucket and implement authenticated access controls

sourceProperties.compliance

Object Optional

Compliance standard and control information

Source: Compliance object with standard, version, and control

sourceProperties.violationDetails

Object Required

Details of the configuration violation

Source: Object with observedValue, expectedValue, and assessmentTime

sourceProperties.ReactivationCount

Integer Optional

Number of times this finding has been reactivated

Source: random_int(0, 5)

Example 2

severity

String Required

Misconfiguration severity level

Source: random_weighted favoring MEDIUM (50%)

Example MEDIUM

Values

CRITICAL Critical misconfiguration requiring immediate fix
HIGH High severity misconfiguration
MEDIUM Medium severity misconfiguration
LOW Low severity misconfiguration

findingClass

String Required

Finding class identifier

Source: Static 'MISCONFIGURATION'

Example MISCONFIGURATION