Vendors / Google Cloud Platform / Security Command Center / SCC Toxic Combination Findings

Event type

SCC Toxic Combination Findings

Attack path combinations

Toxic combination findings from Google Cloud Security Command Center Security Graph, identifying groups of security issues that together create attack paths to high-value resources.

JSON 7 fields Low Generator

attack-path toxic-combination risk-assessment security-graph gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Toxic combination findings identify groups of security issues that, when they occur together, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources.

When generated

›Service account with Owner role has public IP access
›Bucket with public read access contains sensitive data classification
›Compute instance with external IP has overly permissive firewall rules
›IAM binding grants multiple high-privilege roles to same principal
›Network allows unrestricted egress with sensitive data access

Security relevance

Critical

Compliance

NIST 800-53 (AC-3, SC-7) ISO 27001 (A.9.1.2, A.13.1.1) CIS GCP Foundation 2.0 SOC 2 (CC6.1)

Frequency notes

Toxic combination findings are generated by Security Graph analysis when multiple security issues combine to create attack paths. Frequency is lower than individual findings but represents higher risk scenarios. These findings require immediate attention as they indicate exploitable attack paths.

Resources

Docs and tools

Finding Classes - Toxic Combination official Toxic Combinations and Chokepoints Overview official Security Graph official

Generation

Configuration

Base frequency: 5 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.2x
Night hours: 0.9x
Weekend: 0.7x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the toxic combination finding

Source: Constructed with 'toxic-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/toxic-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/toxic-abc123...

category

String Required

Toxic combination category

Example TOXIC_IAM_COMBINATION

Values

TOXIC_IAM_COMBINATION IAM permissions combine to create attack path
TOXIC_NETWORK_COMBINATION Network configurations combine to create attack path
TOXIC_STORAGE_COMBINATION Storage configurations combine to create attack path
TOXIC_COMPUTE_COMBINATION Compute configurations combine to create attack path

sourceProperties.toxicCombination

Object Required

Toxic combination details

Source: Object with description, combinationType, riskScore, components, and remediationGuidance

sourceProperties.toxicCombination.components

Array Required

Array of security issues that combine to create the attack path

Source: Array of component objects with type, resource, and finding references

sourceProperties.toxicCombination.riskScore

Integer Required

Risk score for the toxic combination (0-10)

Source: random_choice([7, 8, 9, 10])

Example 9

severity

String Required

Toxic combination severity level

Source: random_weighted favoring HIGH (50%)

Example CRITICAL

Values

CRITICAL Critical toxic combination
HIGH High severity toxic combination
MEDIUM Medium severity toxic combination

findingClass

String Required

Finding class identifier

Source: Static 'TOXIC_COMBINATION'

Example TOXIC_COMBINATION