Vendors / Google Cloud Platform / Security Command Center / SCC Observation Findings

Event type

SCC Observation Findings

Security-relevant observations

Observation findings from Google Cloud Security Command Center, describing events, configuration details, or issues that may not be problems themselves but could be concerning if the environment were compromised.

JSON 7 fields Medium Generator

observation monitoring behavioral-analysis security-awareness gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Observation findings describe events, configuration details, or other issues in your environment that might not be problems in themselves, but could be concerning if your environment were to be compromised. These findings provide context for security monitoring.

When generated

›Sensitive Data Protection detects sensitive data in resources
›Sensitive Actions Service detects privileged operations
›Unusual API call patterns are observed
›Anomalous network traffic volume is detected
›Unexpected authentication attempts from new locations
›Configuration changes occur outside maintenance windows
›Data access from unusual times or locations

Security relevance

Medium

Compliance

NIST 800-53 (AU-2, AU-6) ISO 27001 (A.12.4.1) SOC 2 (CC7.2) CIS GCP Foundation 2.0

Frequency notes

Observation findings are generated continuously as Security Command Center monitors resource activity and configurations. Frequency is highest during business hours when user activity and resource changes are most common. These findings provide contextual information for security teams.

Resources

Docs and tools

Finding Classes - Observation official Sensitive Data Protection official Sensitive Actions Service official

Generation

Configuration

Base frequency: 15 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.8x
Night hours: 0.8x
Weekend: 0.5x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the observation finding

Source: Constructed with 'obs-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/obs-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/obs-abc123...

category

String Required

Observation category

Example RESOURCE_ACCESS_PATTERN

Values

RESOURCE_ACCESS_PATTERN Unusual resource access pattern observed
API_ACTIVITY Notable API activity observed
NETWORK_TRAFFIC Anomalous network traffic observed
AUTHENTICATION_EVENT Unusual authentication event observed
CONFIGURATION_CHANGE Configuration change observed
DATA_ACCESS Data access pattern observed

sourceProperties.observation

Object Required

Observation details

Source: Object with description, observedAt, observedBy, observationType, and resourceContext

sourceProperties.properties.occurrenceCount

Integer Optional

Number of times this observation has occurred

Source: random_int(1, 100)

Example 15

sourceProperties.properties.observationFrequency

String Optional

Frequency classification of the observation

Example OCCASIONAL

Values

ONCE Observed once
OCCASIONAL Observed occasionally
FREQUENT Observed frequently
CONTINUOUS Observed continuously

severity

String Required

Observation severity level

Source: random_weighted favoring MEDIUM (50%)

Example MEDIUM

Values

CRITICAL Critical observation requiring attention
HIGH High severity observation
MEDIUM Medium severity observation
LOW Low severity observation

findingClass

String Required

Finding class identifier

Source: Static 'OBSERVATION'

Example OBSERVATION