GSP1164

Overview

Security Command Center (SCC) is a security monitoring platform that helps users accomplish the following:

• Discover security-related misconfigurations of Google Cloud resources.
• Report on active threats in Google Cloud environments.
• Fix vulnerabilities across Google Cloud assets.

In this lab, you learn about Security Command Center by exploring the service’s analyzed assets and export features.

Objectives

In this lab, you learn how to perform the following tasks:

• Create a continuous export pipeline to Pub/Sub.
• Export and analyze SCC findings in a BigQuery table.

Prerequisites

It is recommended that you're familiar with the following before starting this lab:

• Cloud computing concepts.
• Google Cloud console.
• The severity classifications for findings (this is recommended but not required).
• Pub/Sub and BigQuery (recommended but not required).

Setup and requirements

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.

This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

• Access to a standard internet browser (Chrome browser recommended).

• Time to complete the lab—remember, once you start, you cannot pause a lab.

How to start your lab and sign in to the Google Cloud console

1. Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:

   • The Open Google Cloud console button
   • Time remaining
   • The temporary credentials that you must use for this lab
   • Other information, if needed, to step through this lab

2. Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).

   The lab spins up resources, and then opens another tab that shows the Sign in page.

   Tip: Arrange the tabs in separate windows, side-by-side.

   Note: If you see the Choose an account dialog, click Use Another Account.

3. If necessary, copy the Username below and paste it into the Sign in dialog.

   {{{user_0.username | "Username"}}}

   You can also find the Username in the Lab Details pane.

4. Click Next.

5. Copy the Password below and paste it into the Welcome dialog.

   {{{user_0.password | "Password"}}}

   You can also find the Password in the Lab Details pane.

6. Click Next.

   Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.

7. Click through the subsequent pages:

   • Accept the terms and conditions.
   • Do not add recovery options or two-factor authentication (because this is a temporary account).
   • Do not sign up for free trials.

After a few moments, the Google Cloud console opens in this tab.

Note: To access Google Cloud products and services, click the Navigation menu or type the service or product name in the Search field.

Activate Cloud Shell

Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.

1. Click Activate Cloud Shell at the top of the Google Cloud console.

2. Click through the following windows:

   • Continue through the Cloud Shell information window.
   • Authorize Cloud Shell to use your credentials to make Google Cloud API calls.

When you are connected, you are already authenticated, and the project is set to your Project_ID, . The output contains a line that declares the Project_ID for this session:

gcloud is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.

3. (Optional) You can list the active account name with this command:

4. Click Authorize.

Output:

5. (Optional) You can list the project ID with this command:

Output:

Scenario

Cymbal Bank is an American retail bank with over 2,000 branches in all 50 states. It offers comprehensive debit and credit services that are built on top of a robust payments platform. Cymbal Bank is a digitally transforming legacy financial services institution.

Cymbal Bank was founded in 1920 under the name Troxler. Cymbal Group acquired the company in 1975 after it had been investing heavily in Cymbal Group's proprietary ATMs. As the bank grew into a national leader, they put strategic emphasis on modernizing the customer experience both in-person at their branches and digitally through an app they released in 2014. Cymbal Bank employs 42,000 people nationwide and, in 2019, reported $24 billion in revenue.

Cymbal Bank is interested in integrating a centralized security monitoring platform to help monitor threats and remediate vulnerabilities across their Google Cloud resources in their corporate banking applications. As a Cloud Security Engineer, you are tasked with learning about Security Command Center's export and analytics features so you can deliver a presentation to the CTO on the services' benefits.

Task 1. Create a continuous export pipeline to Pub/Sub

Security Command Center can export security findings to external resources using several methods, including the following:

• Continuous exports to a BigQuery dataset.
• Continuous exports to Pub/Sub.
• One-time exports to CSV files.
• One-time exports to Cloud Storage buckets as JSON files.

In this task, you explore how to configure continuous exports of findings to Pub/Sub.

Continuous exports to Pub/Sub are typically used for forwarding findings to external security management systems such as Splunk or QRadar.

For the purposes of this lab, you export your findings to a Pub/Sub topic and then simulate an application by fetching the messages from a Pub/Sub subscription.

Create a Pub/Sub topic and subscription

Before you can start configuring an SCC export, you first need to create a Pub/Sub topic and subscription.

1. On the Google Cloud console title bar, type Pub/Sub in the search field and press Enter. Then click on the uppermost search result, Pub/Sub.
2. Click the Create Topic button on the Topics page.
3. Enter in export-findings-pubsub-topic for the Topic ID.
4. Leave all other settings as their defaults and click Create.

This automatically kicks off the creation process for both a Pub/Sub topic and an associated subscription.

5. Click Subscriptions in the left-hand menu.

6. Click on export-findings-pubsub-topic-sub. If you don't see the subscription listed, refresh the browser page.

This provides you with a dashboard of statistics and metrics related to the messages published in this subscription.

Create a continuous export of findings

1. In the Cloud console, on the Navigation menu (), click Security > Risk Overview and then click Settings at the top of the page.

2. Click on the Continuous Exports tab.

3. Click the Create Pub/Sub Export button.

4. For the Continuous export name, enter in export-findings-pubsub.

5. For the Continuous export description, enter in Continuous exports of Findings to Pub/Sub and BigQuery.

6. For the Project name, select , which is the project ID of the project you are working in. (Do not select Qwiklabs Resources).

7. In the Select a Cloud Pub/Sub topic field, select the projects//topics/export-findings-pubsub-topic.

8. Set the findings query to the following:

This query ensures that all new ACTIVE and NOT MUTED findings are forwarded to the newly created Pub/Sub topic.

9. Click Save.

You have now created a continuous export from Security Command Center to Pub/Sub.

Create new findings to export to Pub/Sub

In this section, you create new findings and check how they are exported to Pub/Sub.

1. Open a new Cloud Shell session ().

2. Run the following command to create a new virtual machine:

3. Ensure you receive an output similar to the following.

Output:

This command creates a new VM instance with a public IP address and a default service account attached.

Performing this activity immediately generates three new vulnerability findings:

• Public IP address
• Default service account used
• Compute secure boot disabled

4. On the Google Cloud console title bar, type Pub/Sub in the search field and press Enter. Then click on the uppermost search result, Pub/Sub. Then click Subscriptions in the left-hand menu.

5. Select the export-findings-pubsub-topic-sub subscription.

6. Click the Messages tab.

7. Select the Enable ack messages checkbox.

8. Click the Pull button.

You should receive a list of messages in this subscription. These relate to the public IP address, default service account used, and compute secure boot disabled vulnerabilities.

By pulling the messages from the Pub/Sub subscription, you have simulated the behavior of an application that can forward these messages to another security monitoring system such as Splunk.

Click Check my progress to verify the objective. Create a continuous export pipeline to Pub/Sub

Task 2. Export and analyze SCC findings with BigQuery

SCC findings can also be exported to a BigQuery dataset. This might be useful for building analytical dashboards that you can use to check what type of findings appear in your organization most often.

As of now, configuring continuous exports can only be set using commands (i.e. not in the console).

1. Open a Cloud Shell session ().
2. In your Cloud Shell session, run the following command to create a new BigQuery dataset:

3. You have not used an SCC command line interface in this project yet, so you need to enable the SCC service. Run the following command to enable the service in the current project:

4. Now create a new export by entering this command:

Ensure you receive a similar output message to the following.

Output:

Once new findings are exported to BigQuery, SCC creates a new table. You can now initiate new SCC findings.

5. Run the following commands to create three new service accounts without any IAM permissions and create three user-managed service account keys for them.

Once new findings are created in SCC, they are exported to BigQuery. For storing them, the export pipeline creates a new table called findings.

6. Run the following command to fetch information from BigQuery about newly created findings:

Soon after you should receive output similar to the following.

Output:

Click Check my progress to verify the objective. Export findings to a BigQuery dataset

Export findings to a Cloud Storage bucket and create a BigQuery table

Security Command Center is typically enabled in pre-existing and mature Google Cloud infrastructures. As soon as the SCC is enabled, it starts scanning existing vulnerabilities and eventually might report thousands of findings on existing infrastructure.

The SCC interface might not provide the best way to sort and filter such findings, so exporting these findings to a BigQuery database is a common practice for running analytics against findings.

Direct exporting of findings to BigQuery is not supported yet. Instead, you can use a Google Cloud Storage bucket as an interim storage solution.

Create a Cloud Storage bucket

To export existing findings to a BigQuery interface, you need to export them first to a Cloud Storage bucket. In this section, you create the storage bucket.

1. In the Cloud console, on the Navigation menu (), click Cloud Storage > Buckets.

2. Click the Create button.

3. Every bucket name in Google Cloud must be unique. Set the bucket name to scc-export-bucket-.

4. Click Continue.

5. Set the Location type to Region.

6. Choose for the location.

7. Do not change any other settings. Scroll down the page and click Create.

8. Click the Confirm button when asked whether to "Enforce public access prevention" on this bucket.

Export existing findings as JSONL data

In this section, you export your findings for use in a BigQuery database.

1. In the Cloud console, on the Navigation menu (), click Security > Findings.

2. Click the Export button.

3. From the dropdown list, select Cloud Storage.

4. For the project name, Select the Project ID as (do not select Qwiklabs Resources).

5. Then select the Export path by clicking the Browse button.

6. Click the arrow next to the scc-export-bucket- button.

7. Set the filename to findings.jsonl and click Select.

8. In the Format drop-down list, select JSONL.

9. Change the Time Range to All time.

   Do not modify the default findings query.

   The final "Export to" form should look similar to the following.

10. Click the Export button.

Create a table in BigQuery

In this section, you use the exported findings data to create a table in BigQuery.

1. In the Cloud console, on the Navigation menu (), click BigQuery > BigQuery Studio.

2. From the left-hand Explore menu, click on the Add button.

3. In a new Add window, click on Google Cloud Storage and set the following parameters:

4. Now paste in the following schema:

5. Click the Create table button.

6. Once the new table is created, click the link in the notification that says, Go to table.

7. Click the Preview tab and confirm you can view your existing findings.

Click Check my progress to verify the objective. Export findings to a Cloud Storage bucket and create a BigQuery table

Congratulations!

In this lab, you have learned about Security Command Center and analyzed assets as well as exported findings to BigQuery.

Next steps / Learn more

• Check out the lab titled Identify Application Vulnerabilities with Security Command Center.

Google Cloud training and certification

...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.

Manual Last Updated November 27, 2024

Lab Last Tested March 18, 2024

Copyright 2025 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.