Vendors / Google Cloud Platform / Security Command Center / SCC Vulnerability Findings

Event type

SCC Vulnerability Findings

Software vulnerabilities and security weaknesses

Vulnerability findings from Google Cloud Security Command Center, including OS vulnerabilities, container vulnerabilities, web application vulnerabilities, and weak security configurations detected by various scanners.

JSON 10 fields Medium Generator

vulnerability cve security-scanning compliance gcp

Preview Sample View Schema

CLI Install

meltr templates install google

Overview

What this event covers

Vulnerability findings identify flaws or weaknesses in software programs, containers, or configurations that attackers could exploit to compromise Google Cloud resources. These findings are generated by various Security Command Center scanners.

When generated

›Container Threat Detection identifies vulnerable packages in container images
›VM Manager detects OS-level vulnerabilities on compute instances
›Web Security Scanner finds application vulnerabilities
›Security Health Analytics identifies weak SSL ciphers or open firewall rules
›Vulnerability Assessment scans identify CVE vulnerabilities

Security relevance

High

Compliance

CIS GCP Foundation 2.0 NIST 800-53 (SI-2) ISO 27001 (A.12.6.1) PCI-DSS (6.2) SOC 2 (CC7.2)

Frequency notes

Vulnerability findings are generated during scheduled scans and continuous monitoring. Frequency depends on the number of resources, scan frequency, and vulnerability landscape. New vulnerabilities are typically discovered during business hours when scans are scheduled, but findings can appear at any time.

Resources

Docs and tools

Vulnerability Findings Reference official Container Threat Detection official VM Manager Vulnerability Scanning official Web Security Scanner official

Generation

Configuration

Base frequency: 30 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 1.3x
Night hours: 1.0x
Weekend: 0.7x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

name

String Required

Full resource name of the vulnerability finding

Source: Constructed with 'vuln-' prefix

Format organizations/{org_id}/sources/{source_id}/locations/global/findings/vuln-{finding_id}

Example organizations/123456789/sources/9732761411165682985/locations/global/findings/vuln-abc123...

category

String Required

Vulnerability category classification

Example OS_VULNERABILITY

Values

OS_VULNERABILITY Operating system package vulnerability
CONTAINER_VULNERABILITY Container image vulnerability
WEB_APPLICATION_VULNERABILITY Web application security vulnerability
OPEN_FIREWALL Overly permissive firewall configuration
WEAK_SSL_CIPHER Weak SSL/TLS cipher configuration

sourceProperties.vulnerability.cve

Object Required

Common Vulnerabilities and Exposures (CVE) information

Source: CVE object with ID, CVSSv3 scores, and references

sourceProperties.vulnerability.cve.id

String Required

CVE identifier

Source: CVE-{year}-{random_int(1000, 9999)}

Format CVE-YYYY-NNNN

Example CVE-2024-1234

sourceProperties.vulnerability.cve.cvssv3.baseScore

Number Required

CVSS v3 base score (0.0-10.0)

Source: random_choice of common CVSS scores

Example 7.5

sourceProperties.vulnerability.vulnerablePackage

Object Required

Vulnerable package information

Source: Package object with name and version

sourceProperties.vulnerability.fixedPackage

Object Optional

Fixed package version information

Source: Package object with name, version, and type

sourceProperties.scannerName

String Required

Scanner that identified the vulnerability

Example Container Threat Detection

Values

Container Threat Detection Container image vulnerability scanner
VM Manager VM OS vulnerability scanner
Web Security Scanner Web application vulnerability scanner
Security Health Analytics Configuration vulnerability scanner

severity

String Required

Vulnerability severity level

Source: random_weighted favoring MEDIUM (45%)

Example HIGH

Values

CRITICAL Critical vulnerability (CVSS 9.0-10.0)
HIGH High severity vulnerability (CVSS 7.0-8.9)
MEDIUM Medium severity vulnerability (CVSS 4.0-6.9)
LOW Low severity vulnerability (CVSS 0.1-3.9)

findingClass

String Required

Finding class identifier

Source: Static 'VULNERABILITY'

Example VULNERABILITY