Vendors / Google Cloud Platform / Security Command Center / SCC Posture Violation Findings

Event type

SCC Posture Violation Findings

Security posture and compliance violations

Posture violation findings from Google Cloud Security Command Center, identifying resource configurations that don't align with your organization's security posture or Compliance Manager cloud controls.

JSON 7 fields Medium Generator

posture compliance security-baseline policy-violation gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Posture violation findings describe resource configurations that don't align with your organization's security posture templates or Compliance Manager cloud controls. These findings help maintain consistent security standards across GCP resources.

When generated

›Resources don't meet Secure by Default posture template requirements
›Compliance standard controls are violated (CIS, NIST, PCI-DSS, ISO 27001)
›Organization security policies are not followed
›Custom posture constraints are violated
›Security baseline requirements are not met

Security relevance

High

Compliance

CIS GCP Foundation 2.0 NIST 800-53 PCI DSS ISO 27001 SOC 2

Frequency notes

Posture violation findings are generated during security posture assessments. Frequency increases when new resources are created or existing resources are modified. Business hours typically see more violations as development and deployment activities occur.

Resources

Docs and tools

Finding Classes - Posture Violation official Security Posture Overview official Compliance Manager official Posture Templates official

Generation

Configuration

Base frequency: 20 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.6x
Night hours: 0.7x
Weekend: 0.4x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the posture violation finding

Source: Constructed with 'posture-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/posture-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/posture-abc123...

category

String Required

Posture violation category

Example POSTURE_BASELINE_VIOLATION

Values

POSTURE_BASELINE_VIOLATION Violation of security baseline requirements
COMPLIANCE_STANDARD_VIOLATION Violation of compliance standard control
SECURITY_POLICY_VIOLATION Violation of organization security policy
ORGANIZATION_POLICY_VIOLATION Violation of organization policy constraint

sourceProperties.postureViolation.postureTemplate

String Required

Posture template that was violated

Example Secure by Default - Essentials

Values

Secure by Default - Essentials Essential secure by default requirements
Secure by Default - Extended Extended secure by default requirements
CIS GCP Foundation 2.0 CIS benchmark requirements
NIST 800-53 NIST security controls
PCI DSS PCI DSS requirements
ISO 27001 ISO 27001 requirements

sourceProperties.compliance

Object Optional

Compliance standard and control information

Source: Object with standard, version, control, and controlDescription

sourceProperties.postureViolation.remediationGuidance

String Required

Guidance for remediating the posture violation

Source: Context-specific remediation guidance

Example Apply Secure by Default posture template

severity

String Required

Posture violation severity level

Source: random_weighted favoring MEDIUM (45%)

Example HIGH

Values

CRITICAL Critical posture violation
HIGH High severity posture violation
MEDIUM Medium severity posture violation
LOW Low severity posture violation

findingClass

String Required

Finding class identifier

Source: Static 'POSTURE_VIOLATION'

Example POSTURE_VIOLATION