Two types of services run on Security Command Center: built-in services and integrated services. Built-in services are part of Security Command Center. Integrated services are Google Cloud or third-party services that provide findings to Security Command Center.
This page describes how to configure built-in services and integrated services.
Built-in services of Security Command Center Standard, Premium, and Enterprise service tiersThe following built-in services are part of Security Command Center:
You can't enable or disable the Security posture service; it is available by default when you activate the Security Command Center Enterprise tier.
Most built-in services can be enabled for your entire organization or just for selected folders or projects. By default, folders and projects inherit service enablement settings from their parent organization or folder.
The Vulnerability Assessment for AWS service can be enabled only for a Google Cloud organization and requires that you establish a connection between Security Command Center and AWS.
The Container Threat Detection service can be enabled only for clusters. For information about required permissions for Container Threat Detection, see Required IAM permissions.
Enable or disable a built-in serviceTo enable or disable a Security Command Center service for a resource, do the following:
In the Google Cloud console, go to the Security Command Center page.
Select the organization, folder, or project for which you need to manage services.
Click settings Settings.
For the service that you want to modify, click Manage settings.
On the Service enablement tab, in the hierarchical view of resources, select the organization, folder, project, or container for which you need to enable the service. If you are enabling the Vulnerability Assessment for AWS service, select Enable.
For that resource, set the service to Enable, Disable, or Inherit.
Some services, like Security Health Analytics, operate using batch scans. When you disable such a service, the change might not be reflected immediately. The change is effective after all ongoing batch scans are complete. This can lead to a scenario where new vulnerabilities are still detected for a short period after you disable the service.
View and edit the detectors of a serviceFor some services (for example, Security Health Analytics), you can enable or disable certain detectors, also known as modules. To configure the detectors of a service and view their current statuses, do the following:
In the Google Cloud console, go to the Security Command Center page.
Select the organization, folder, or project for which you need to manage services.
Click settings Settings.
For the service that you want to view, click Manage settings.
Click the Modules tab. The service's detectors are displayed, along with their respective statuses.
Find the detector that you want to modify, and set its status to Enable or Disable.
You can add an integrated service to an organization-level activation of Security Command Center. Project-level activations don't support integrated Google Cloud services.
Security Command Center provides the following integrated services:
For more information about these services, see Detection services for vulnerabilities and threats.
To enable an integrated service, follow these steps:
In the Google Cloud console, go to the Security Command Center page.
Select your organization or project.
Click settings Settings.
Click the Integrated services tab.
Next to the integrated source that you want to enable, click the Status list and select Enable.
Findings from the services that you enable are displayed on the Findings page in the Security Command Center dashboard.
Some Google Cloud security services require additional integration steps that you must complete. See the following:
To disable an integrated service, next to its name, click the list and select Disable.
Add a third-party security service Standard, Premium, and Enterprise service tiers (requires organization-level activation)Organization-level activations of Security Command Center can display findings from third-party security services that have registered as Cloud Marketplace partners.
Project-level activations of Security Command Center don't support third-party services.
To integrate security services that aren't registered as Cloud Marketplace partners, ask the providers to complete the guide to Onboard as a Security Command Center partner.
To add a new third-party security service to Security Command Center, you set up the security service, and then enable it in the Google Cloud console.
Before you beginTo add a security service for a registered Cloud Marketplace partner, you need the following:
roles/securitycenter.admin)roles/iam.serviceAccountAdmin)To set up a third-party security service, you need a service account for that service. When you add the new security service, you can choose from the following service account options:
To set up a new security service that's already registered as a Cloud Marketplace partner, complete the following:
Go to the Security Command Center Services Marketplace page in the Google Cloud console.
The Marketplace page displays security services that are directly associated with Security Command Center.
On the security service provider page in the Cloud Marketplace, follow any provider setup instructions in the Overview.
When configured correctly, the security service you added is available in Security Command Center.
After you set up a new security service, you need to enable it in the Google Cloud console.
Enable the security serviceThird-party security services use service accounts that might be outside your organization.
To enable a third-party service, follow these steps:
In the Google Cloud console, go to the Security Command Center page.
Select your organization or project.
Click settings Settings.
Click the Integrated services tab.
Next to the integrated source that you want to enable, click the Status list and select Enable.
Findings from the services that you enable are displayed on the Findings page in the Security Command Center dashboard.
Change the service account of a security serviceYou can change the service account used for a third-party security service, for example to address service account leakage or rotation. To change the service account for a security service, you need to update it in the Google Cloud console. Afterward, follow the service provider's instructions to update the service account for their service.
In the Google Cloud console, go to the Security Command Center page.
Select your organization or project.
Click settings Settings.
Click the Integrated services tab.
In the drop-down list next to the integrated service:
On the Edit provider panel that appears, enter the new service account, then click Submit.
In the drop-down list next to the integrated service, select Enabled to enable the security service.
When configured correctly, the service account for the integrated service is updated in Security Command Center. Follow the service provider's instructions to update the service account information for their service.
What's nextRetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4