MELTr
Home Vendors Search Download
Login
Vendors / Google Cloud Platform / Security Command Center / Security Command Center Findings
Google Cloud Platform logo

Event type

Security Command Center Findings

Security threats and compliance violations

Security findings from Google Cloud Security Command Center V2, including custom threats, vulnerabilities, and policy violations detected across GCP resources and projects.

JSON 19 fields Medium Generator

security threat-detection gcp compliance cloud-security
Preview Sample View Schema
CLI Install
meltr templates install google

Overview

What this event covers

Security findings generated by Google Cloud Security Command Center V2, providing centralized visibility into security threats, misconfigurations, and compliance violations across Google Cloud Platform resources.

When generated

  • ›When Security Command Center detects a custom threat pattern
  • ›When security policies are violated
  • ›When anomalous activity is detected on GCP resources
  • ›When vulnerability scanners identify security issues
  • ›When compliance violations are detected

Security relevance

High

Compliance

CIS Google Cloud Platform Foundation Benchmark ISO 27001 SOC 2 PCI DSS HIPAA

Frequency notes

Security findings are generated based on continuous monitoring of GCP resources. Frequency varies based on security posture, with more findings during active development periods and fewer during stable operations. Business hours typically see higher finding rates due to increased resource changes and deployments.

Resources

Docs and tools

Security Command Center Documentation official Finding Schema Reference official Security Command Center Best Practices official Google Cloud Console - Security Command Center Web interface for viewing and managing Security Command Center findings gcloud CLI - SCC Commands Command-line tool for interacting with Security Command Center

Generation

Configuration

Base frequency
15 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.0x
Night hours
0.6x
Weekend
0.4x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

timestamp
DateTime Required

ISO 8601 timestamp when the log was generated

Source: now() | iso8601

Format ISO 8601
Example 2025-08-22T15:17:36.446Z
product
String Required

Product identifier for Security Command Center

Source: Static string

Example GOOGLE_SECURITY_COMMAND_CENTER_V2
type
String Required

Type of security source (Security Graph, Security Health Analytics, etc.)

Source: Static string

Example Security Graph
severity
String Required

Overall severity level of the finding

Source: random_choice(['Critical', 'High', 'Medium', 'Low'])

Example High
Values
  • Critical Critical severity requiring immediate attention
  • High High severity requiring prompt attention
  • Medium Medium severity requiring attention
  • Low Low severity for informational purposes
title
String Required

Human-readable title describing the security finding

Source: random_choice of common threat titles

Example Custom Threat
source_json.finding.canonicalName
String Required

Canonical resource name of the finding in the project scope

Source: Constructed from random project ID, source ID, and finding hash

Example projects/224068114279/sources/9732761411165682985/locations/global/findings/0c686e1c1add482f88aa11e637e1938a
source_json.finding.category
String Required

Category classification of the security finding

Source: random_choice of security categories

Example Custom Threat
Values
  • Custom Threat Custom threat pattern detected
  • Malware Malware detected on resources
  • Data Exfiltration Suspicious data transfer patterns
  • Unauthorized Access Unauthorized access attempts or breaches
  • Privilege Escalation Privilege escalation detected
source_json.finding.createTime
DateTime Required

Timestamp when the finding was first created

Source: now() | iso8601

Format ISO 8601
Example 2025-08-22T15:17:36.446Z
source_json.finding.eventTime
DateTime Required

Timestamp when the security event occurred

Source: (now() | subtract_seconds(random_int(1, 300))) | iso8601

Format ISO 8601
Example 2025-08-22T15:17:34.570Z
source_json.finding.externalUri
String Optional

External URI for additional details about the finding

Source: Constructed GCP console URL with organization ID

Example https://console.cloud.google.com/security/command-center/findings
source_json.finding.mute
String Required

Mute status of the finding

Source: random_choice(['UNDEFINED', 'MUTED', 'UNMUTED'])

Example UNDEFINED
Values
  • UNDEFINED Mute status not defined
  • MUTED Finding is muted and won't trigger alerts
  • UNMUTED Finding is active and will trigger alerts
source_json.finding.severity
String Required

Severity level in uppercase format

Source: random_choice(['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'])

Example HIGH
Values
  • CRITICAL Critical severity
  • HIGH High severity
  • MEDIUM Medium severity
  • LOW Low severity
source_json.finding.state
String Required

Current state of the security finding

Source: random_choice(['ACTIVE', 'INACTIVE'])

Example ACTIVE
Values
  • ACTIVE Finding is currently active
  • INACTIVE Finding has been resolved or is no longer active
source_json.resource.cloudProvider
String Required

Cloud provider identifier

Source: Static string

Example GOOGLE_CLOUD_PLATFORM
source_json.resource.displayName
String Required

Human-readable display name for the GCP project

Source: registry.get_organization_field('gcp_project_name') or random_string

Example komand-211617
source_json.resource.gcpMetadata.organization
String Required

GCP organization resource path

Source: Constructed from organization ID

Example organizations/635513451221
source_json.resource.gcpMetadata.parentDisplayName
String Required

Display name of the parent organization

Source: registry.get_organization().name

Example komandops.org
source_json.resource.service
String Required

GCP service that owns the resource

Source: random_choice of common GCP services

Example cloudresourcemanager.googleapis.com
source_json.resource.type
String Required

GCP resource type identifier

Source: random_choice of common GCP resource types

Example google.cloud.resourcemanager.Project