> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform - Security Command Center

> Security Command Center (SCC) is Google Cloud’s centralized security and risk management platform. It helps detect, investigate, and remediate security threats, vulnerabilities, and misconfigurations across Google Cloud resources.

### Purpose

The Google Cloud Platform integration connects AirMDR to Google Cloud APIs by using a dedicated service account.

After the connection is configured, AirMDR can retrieve supported security and operational information from the selected Google Cloud organization and projects.

AirMDR provides two configuration methods:

| Setup method | Description | Recommended for |
| :- | :- | :- |
| [**Use a Script**](https://docs.airmdr.com/Integrations/GCP-SCC#method-1-use-a-script-setup-steps) | Generates a Python script that automates service-account creation and related configuration steps. | New integrations and users who want a simplified setup |
| [**Do It Yourself**](https://docs.airmdr.com/Integrations/GCP-SCC#method-2-do-it-yourself-setup-steps) | Requires the administrator to manually create the service account, assign IAM roles, and generate the JSON key. | Organizations that require manual review and execution of every configuration step |

<Tip>
  **Recommended:** Use the "**[Use a Script](https://docs.airmdr.com/Integrations/GCP-SCC#method-1-use-a-script-setup-steps)"** method to reduce manual configuration. Use **Do It Yourself** when your organization requires changes to be performed manually through the Google Cloud Console.
</Tip>

### Pre-requisites

<Check>
  User Organization must define **Owner** or **Security Admin** role (`roles/owner` or `roles/securitycenter.admin`) in your GCP organization.
</Check>

<Check>
  User must have **Organization Admin** permissions to enable services at the organization level.
</Check>

<Check>
  <Accordion title="Service Tier Requirements ">
    1. Select your organization, and enter keyword "Security" in the search bar.
    2. Select the **Security Command Center**.
           <Frame>
             <img src="https://mintcdn.com/airmdr/IIGsP2QsA3QDO3l7/images/GCPSCC3-1.png?fit=max&auto=format&n=IIGsP2QsA3QDO3l7&q=85&s=edc55d03f87a2fab3dad98901922a21d" alt="GCPSCC3 1" width="876" height="393" data-path="images/GCPSCC3-1.png" />
           </Frame>
    3. Click on "**GET THE SECURITY COMMAND CENTER**".
    4. Make sure Service Tier is **Premium (Paid)** for your organization.<br /><br />**SCC Editions: Standard vs. Premium Feature support (For reference)**
       | Feature | Standard (Free) | Premium (Paid) |
       | :- | :- | :- |
       | Security Health Analytics | ✅ Basic | ✅ Advanced |
       | Event Threat Detection | ❌ No | ✅ Yes |
       | Container & VM Threat Detection | ❌ No | ✅ Yes |
       | Continuous Compliance Monitoring | ❌ No | ✅ Yes |
       | Automated Security Insights | ❌ No | ✅ Yes |
  </Accordion>
</Check>

<Accordion title="Authentication">
  AirMDR uses a Google Cloud service account JSON key to authenticate with Security Command Center.

  ### Required Authentication Details

  | AirMDR field | Required | What to enter | Where to get it |
  | :- | -: | :- | :- |
  | `Service_account_json` | Yes | Complete JSON credentials generated for the AirMDR service account | Generated by the script or downloaded from **IAM & Admin → Service Accounts → Keys** |
  | `Organization_id` | Yes | Numeric Google Cloud Organization ID | Google Cloud organization settings |
  | `Project_id` | During script generation | Unique textual ID of the project in which the service account will be created | Google Cloud project settings or project selector |
  | `Service_account_id` | Optional during script generation | Unique ID for the AirMDR service account | Enter a preferred value or use the value recommended by AirMDR |

  <Accordion title="Credential example">
    The `Service_account_json` field must contain the complete JSON object, not only the service-account email or key ID.

    ```text theme={null}

      "type": "service_account",
      "project_id": "example-project-id",
      "private_key_id": "REDACTED",
      "private_key": "-----BEGIN PRIVATE KEY-----\nREDACTED\n-----END PRIVATE KEY-----\n",
      "client_email": "airmdr-integration-gcp@example-project-id.iam.gserviceaccount.com",
      "client_id": "REDACTED",
      "token_uri": "https://oauth2.googleapis.com/token"

    ```

    <Warning>
      Never use actual service-account credentials in documentation, screenshots, tickets, email, chat, or source-code repositories.
    </Warning>

    ### Runtime access model

    The AirMDR service account uses read-only permissions for the currently documented skills. It does not require permission to modify Google Cloud resources.

    The script performs temporary read/write setup actions because it creates the service account, assigns roles, enables services where applicable, and generates a service-account key.
  </Accordion>
</Accordion>

<AccordionGroup>
  <Accordion title="Role-Based Access Considerations">
    The service account must have permission to read Security Command Center findings from the target organization.

    Recommended minimum role:

    | Role | Purpose |
    | :- | :- |
    | Security Center Findings Viewer | Allows the service account to retrieve Security Command Center findings. |

    Additional roles may be required depending on the customer’s GCP hierarchy, organization policies, and AirMDR use case.

    <Note>
      Use least-privilege access. Assign only the permissions required for AirMDR to retrieve Security Command Center findings.
    </Note>
  </Accordion>

  <Accordion title="Setup-operator permissions">
    The following permissions are required only by the administrator running the script or completing the manual setup. They are not runtime permissions for the AirMDR service account.

    | Setup activity | Example Google Cloud role | Scope | Access type |
    | - | - | - | - |
    | Enable required APIs | Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) | Integration project | Read/Write |
    | Create the service account | Service Account Admin (`roles/iam.serviceAccountAdmin`) | Integration project | Read/Write |
    | Create the JSON key | Service Account Key Admin (`roles/iam.serviceAccountKeyAdmin`) | Service account or project | Read/Write |
    | Grant organization-level IAM roles | Organization Administrator (`roles/resourcemanager.organizationAdmin`) | Organization | Read/Write |
    | Configure Security Command Center, if required | Security Center Admin (`roles/securitycenter.admin`) | Organization | Read/Write |
  </Accordion>

  <Accordion title="Supported Versions">
    | Component | Supported Details |
    | :- | :- |
    | Cloud Platform | Google Cloud Platform |
    | Security Product | Google Cloud Security Command Center |
    | Authentication Method | Service Account JSON |
    | Required Identifier | Organization ID |
    | AirMDR Configuration Type | Cloud API-based integration |
    | API Used | Security Command Center API |
    | Base Endpoint | `https://console.cloud.google.com` |
  </Accordion>
</AccordionGroup>

### Method 1: Use a Script Setup Steps

Use this method to automate the service-account and IAM configuration steps.

<Steps>
  <Step title="Obtain the Google Cloud Organization ID">
    The Organization ID already exists in Google Cloud and must be entered before the script is generated.

    1. Sign in to the [Google Cloud Console](https://console.cloud.google.com/).
    2. Open the project selector in the top navigation bar.
    3. Select the required organization.
    4. Open the organization settings or **Manage resources** page.
    5. Locate **Organization ID**.
    6. Copy the numeric value.
           <Note>
             Do not enter the organization name, domain, project name, or project number in the `Organization_id` field.
           </Note>
  </Step>

  <Step title="Open the GCP connection form in AirMDR">
    1. Sign in to [AirMDR](https://app.airmdr.com/).
    2. In the left navigation pane, select **Integrations**.
    3. Search for **Google Cloud Provider**.
    4. Open the integration.
    5. Select the **Connections** tab.
    6. Click **+ Create**.
    7. Enter a unique instance name.<br />Example: `example-org-gcp`
    8. Select **Use a Script**.
  </Step>

  <Step title="Generate and download the script">
    1. Under **Select the script language you want to use**, select **Python** or **Terraform**.
    2. Enter the following information:
       | Field | Value |
       | - | - |
       | `Organization_id` | Numeric Google Cloud Organization ID |
       | `Project_id` | Project ID in which the AirMDR service account will be created |
       | `Service_account_id` | Optional preferred service-account ID, such as `airmdr-integration-gcp` |
    3. Review the entered Organization ID and Project ID.
    4. Click the **Download** icon.
           <Check>
             The selected script (Python or Terraform) is downloaded to your computer.
           </Check>

    > **Security recommendation:** Review the downloaded script before running it. Confirm that the organization, project, service-account ID, APIs, and IAM roles match the approved configuration.
  </Step>

  <Step title="Open Google Cloud Shell">
    1. Open [Google Cloud Shell](https://shell.cloud.google.com/).
    2. Confirm that you are signed in with the approved Google Cloud administrator account.
    3. Verify that the correct project is active.<br />You can optionally check the active project by running: `gcloud config get-value project`
  </Step>

  <Step title="Upload the script">
    Upload the downloaded script by using one of the following methods:

    * Drag the file from your computer and drop it into the Cloud Shell terminal window.<br />(**OR)**
    * Select the **three-dot menu** at the top of the Cloud Shell pane, and then select **Upload**.

    The uploaded file is placed in the Cloud Shell home directory.

    Confirm that the file is available: 

    ```text theme={null}
    ls -l
    ```
  </Step>

  <Step title="Run the script">
    Run the uploaded Python script:

    ```text theme={null}
    python3 script.py
    ```

    If the downloaded file has a different name, replace `script.py` with the actual filename:

    ```text theme={null}
    python3 <downloaded-script-name>.py
    ```

    <Note>
      The account running the script must have permission to perform every operation included in the script. Using a script reduces manual steps but does not remove Google Cloud permission requirements.
    </Note>
  </Step>

  <Step title="Review the script output">
    After the script completes:

    1. Confirm that it reports successful service-account creation and IAM role assignment.
    2. Copy the `Service_account_json` generated by the script.
    3. Copy or confirm the `Organization_id` shown in the output.
    4. Do not close the terminal until the required values have been entered in AirMDR.
           <Tip>
             The Organization ID is not newly generated. The script returns or confirms the Organization ID supplied during script creation.
           </Tip>
  </Step>

  <Step title="Provide the credentials in AirMDR">
    1. Return to the AirMDR connection form.
    2. In `Service_account_json`, paste the complete JSON credentials generated by the script.
    3. In `Organization_id`, enter the numeric Organization ID.
    4. Expand **Advanced Configuration** only if additional settings are required.
    5. Click **Save**.
    6. Validate the connection.
  </Step>
</Steps>

### Method 2: Do It Yourself Setup Steps

This section explains how to collect the two required values for AirMDR:

* `service_account_json`
* `organization_id`

<Steps>
  <Step title="Open Google Cloud Console">
    1. Sign in to the [Google Cloud Console](https://console.cloud.google.com/welcome).
    2. In the ribbon, click on your project name.
    3. From the top project selector, select the project that will be used for the AirMDR integration.
           <Check>
             Confirm that you are working under the correct organization and project.
           </Check>
           <Note>
             The selected project is where the service account and API configuration will be managed.
           </Note>
  </Step>

  <Step title="Enable Security Command Center API">
    1. In [Google Cloud Console](https://console.cloud.google.com/welcome), open the navigation menu.
    2. Go to **APIs & Services**.
    3. Select **Library**.
    4. Search for **Security Command Center API**.
    5. Open the API page.
    6. Click **Enable**.
  </Step>

  <Step title="Create a Service Account">
    1. In [Google Cloud Console](https://console.cloud.google.com/welcome), open the navigation menu.
    2. Go to **IAM & Admin**.
    3. Select **Service Accounts**.
    4. Click **Create Service Account**.
    5. Enter the following details:
       | Field | Example Value | Description |
       | :- | :- | :- |
       | Service account name | `airmdr-integration-gcp` | Display name for the service account. |
       | Service account ID | `airmdr-integration-gcp` | Unique ID generated for the service account. |
       | Description | `Service account for AirMDR GCP SCC integration` | Optional description for tracking usage. |
    6. Click **Create and Continue**.
    7. Skip role assignment (Permissions and Principals with access) at this step if the role will be assigned at the organization level.
    8. Click **Done**.
  </Step>

  <Step title="Generate the Service Account JSON Key">
    1. Search the service account created for AirMDR.<br />For example: `airmdr-integration-gcp`(as shown)
           <Frame>
             <img src="https://mintcdn.com/airmdr/o7rju27H5oPIs-M0/images/GCP14-1.png?fit=max&auto=format&n=o7rju27H5oPIs-M0&q=85&s=9ed78522fdf0e1a469353b4b432e0b1c" alt="GCP14 1" width="1983" height="572" data-path="images/GCP14-1.png" />
           </Frame>
    2. Open the **Keys** tab.
    3. Click **Add Key** drop-down.
           <Frame>
             <img src="https://mintcdn.com/airmdr/eOUD4tHV98KHAO_H/images/GCP13-1.png?fit=max&auto=format&n=eOUD4tHV98KHAO_H&q=85&s=99dafd4040b1b5dea382c21867705859" alt="GCP13 1" width="1950" height="614" data-path="images/GCP13-1.png" />
           </Frame>
    4. Select **Create new key**.
    5. Select **JSON** as the key type.
           <Frame>
             <img src="https://mintcdn.com/airmdr/eOUD4tHV98KHAO_H/images/GCP12.png?fit=max&auto=format&n=eOUD4tHV98KHAO_H&q=85&s=9f15744b289fad93fc1678828055e81c" alt="GCP12" width="621" height="423" data-path="images/GCP12.png" />
           </Frame>
    6. Click **Create**.
           <Note>
             Permission updates for service accounts may take a few minutes to propagate. If access is not granted immediately, wait a few minutes and try again.
           </Note>
    7. The JSON file is downloaded automatically.<br />The downloaded file is the `service_account_json` required in AirMDR.<br />**Example JSON Structure:**
           <Frame>
             <img src="https://mintcdn.com/airmdr/eOUD4tHV98KHAO_H/images/GCP16.png?fit=max&auto=format&n=eOUD4tHV98KHAO_H&q=85&s=9f585c517b41c79611cc9d9c9d770538" alt="GCP16" width="2036" height="484" data-path="images/GCP16.png" />
           </Frame>
           <Warning>
             Store the JSON key securely. Do not share it over email, chat, or unsecured channels.
           </Warning>
  </Step>

  <Step title="Assign IAM Role to the Service Account">
    1. In [Google Cloud Console](https://console.cloud.google.com/welcome), go to **IAM & Admin**.
    2. Select **IAM**.
           <Check>
             Make sure the correct <u>organization</u> is selected.
           </Check>
           <Frame>
             <img src="https://mintcdn.com/airmdr/5MpXBV8t73tjItG-/images/GCPSCC7-3.png?fit=max&auto=format&n=5MpXBV8t73tjItG-&q=85&s=dcc731aa71ff931fd30e16a12fa23836" alt="GCPSCC7 3" width="804" height="513" data-path="images/GCPSCC7-3.png" />
           </Frame>
    3. Click **Grant Access**.
           <Frame>
             <img src="https://mintcdn.com/airmdr/IIGsP2QsA3QDO3l7/images/GCPSCC6-1.png?fit=max&auto=format&n=IIGsP2QsA3QDO3l7&q=85&s=5f22be0ea797741d865363af61867362" alt="GCPSCC6 1" width="599" height="237" data-path="images/GCPSCC6-1.png" />
           </Frame>
    4. In **Add Principals → New principals**, enter the service account email.<br />Example: [airmdr-integration-gcp@example-project.iam.gserviceaccount.com](mailto:airmdr-integration-gcp@example-project.iam.gserviceaccount.com)
    5. In **Assign Roles → Select a role**, search for and select:
       * **Security Center Findings Viewer (**`roles/securitycenter.viewer`**)** → Grants read access
             <Check>
               Make sure the correct Organisation is selected under **Resource**.<br />For example: [airmdr.com](http://airmdr.com) (Reference only as shown below)
             </Check>
    6. Skills and Required IAM Roles

       | AirMDR skill | Purpose | Required Google Cloud role | Role ID | Access | Recommended scope |
       | :- | :- | :- | :- | :- | :- |
       | Get GCP security command center findings | Retrieves Security Command Center findings | Security Center Findings Viewer | `roles/securitycenter.findingsViewer` | Read-only | Organization |
       | Get GCP Logs | Retrieves Google Cloud logs | Logs Viewer | `roles/logging.viewer` | Read-only | Target projects or organization |
       | Get GCP Configuration Changes | Retrieves configuration-change events from Cloud Logging | Logs Viewer | `roles/logging.viewer` | Read-only | Target projects or organization |
       | Get GCP GKE Workload Metrics | Retrieves GKE workload metrics from Cloud Monitoring | Monitoring Viewer | `roles/monitoring.viewer` | Read-only | Target projects or organization |
       | Search GCP Assets | Searches Google Cloud resource metadata | Cloud Asset Viewer | `roles/cloudasset.viewer` | Read-only | Organization |
       | Search GCP IAM Policies | Searches IAM policies associated with Google Cloud resources | Cloud Asset Viewer | `roles/cloudasset.viewer` | Read-only | Organization |
       | Analyze GCP IAM Policy | Analyzes IAM relationships and access policies | Cloud Asset Viewer | `roles/cloudasset.viewer` | Read-only | Organization |
       | Get GCP Compute Instance | Retrieves Compute Engine instance information | Compute Viewer | `roles/compute.viewer` | Read-only | Target projects or organization |
       | Get GCP Instance Effective Firewalls | Retrieves effective firewall rules for an instance | Compute Viewer | `roles/compute.viewer` | Read-only | Target projects or organization |
       | Get GCP Cloud Armor Policy | Retrieves Cloud Armor security-policy information | Compute Viewer | `roles/compute.viewer` | Read-only | Target projects or organization |
       | List GCP Service Account Keys | Lists service-account key metadata | Security Reviewer | `roles/iam.securityReviewer` | Read-only | Target projects or organization |
       | Get GCP Org Policy | Retrieves organization-policy configuration | Organization Policy Viewer | `roles/orgpolicy.policyViewer` | Read-only | Organization |
       | Get GCP IAM Recommendations | Retrieves IAM recommendations and insights | IAM Recommender Viewer | `roles/recommender.iamViewer` | Read-only | Target projects or organization |
       | List GCP Container Vulnerabilities | Retrieves Container Analysis occurrence and vulnerability information | Container Analysis Occurrences Viewer | `roles/containeranalysis.occurrences.viewer` | Read-only | Target projects or organization |
       | List GCP VPC SC Perimeters | Retrieves VPC Service Controls perimeter configuration | Access Context Manager Reader | `roles/accesscontextmanager.policyReader` | Read-only | Organization access policy |

           <Tip>
             To view the details of Input Parameters and Output for the respective skills

             * Go to [AirMDR → Google Cloud Provider](https://app.airmdr.com/integrationsv2/be2de942-b131-4612-b944-a8631b2cba14/skills?search=google+clo) Integration page.
             * Select the **Skills** tab and click on the required listed skill
           </Tip>
    7. Click **Save**.
           <Frame>
             <img src="https://mintcdn.com/airmdr/eOUD4tHV98KHAO_H/images/GCP11-1.png?fit=max&auto=format&n=eOUD4tHV98KHAO_H&q=85&s=afa79fb0afdca90e49b8f88dc358d2da" alt="GCP11 1" width="574" height="759" data-path="images/GCP11-1.png" />
           </Frame>

    <Check>
      When finished, you should have a service account named **airmdr-agent**, credentials for this service account in a JSON file saved to your host.
    </Check>
  </Step>

  <Step title="Get the Organization ID">
    1. In [Google Cloud Console](https://console.cloud.google.com/welcome), open the project selector at the top.
           <Frame>
             <img src="https://mintcdn.com/airmdr/IIGsP2QsA3QDO3l7/images/GCPSCC7-2.png?fit=max&auto=format&n=IIGsP2QsA3QDO3l7&q=85&s=a66e34aac0b5fc6752ea1ae90bf519c7" alt="GCPSCC7 2" width="804" height="513" data-path="images/GCPSCC7-2.png" />
           </Frame>
    2. Select the required organization.
    3. Click the three-dot menu or **More** option.
    4. Select **Settings**.
    5. Locate the **Organization ID** field.
    6. Copy the numeric organization ID.<br />Example: **123456789012**
           <Check>
             This value is the `organization_id` required in AirMDR.
           </Check>
  </Step>
</Steps>

### Configure GCP Security Command Center API in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **Integrations**.
3. Use the search option, enter the keyword "**Google Cloud Provider**", select the **Connections** tab, and click **+ Create** button.
4. Enter an unique name to the Instance (e.g., `your org name-GCP`) to easily identify the user connection by AirMDR.
5. Enter the application credentials like **Service\_account\_json** and **Organization\_id** in the Authentication Details field params, and click **Save**.

### Additional Information

<AccordionGroup>
  <Accordion title="🧰 Error Handling">
    | **Error** | **Possible Cause** | **Recovery Step** |
    | :- | :- | :- |
    | Invalid service account JSON | JSON file is incomplete, modified, or incorrectly pasted. | Download a new JSON key and update the AirMDR connection. |
    | Permission denied | Required IAM role is missing. | Assign Security Center Findings Viewer role to the service account. |
    | Organization not found | Incorrect organization ID entered. | Recheck the organization ID from Google Cloud Console. |
    | API not enabled | Security Command Center API is disabled. | Enable the Security Command Center API from APIs & Services. |
    | No findings available | SCC is not enabled or there are no findings for the selected scope. | Confirm SCC activation and findings availability in Google Cloud. |
    | Authentication failed | Service account key is revoked or expired. | Generate a new key and update the integration. |

    ***
  </Accordion>

  <Accordion title="🔄 Monitoring & Logs">
    **Where to Monitor**

    | Location | What to Check |
    | :- | :- |
    | AirMDR Integration Page | Connection status and validation result |
    | AirMDR Logs | Authentication, API, and ingestion errors |
    | Google Cloud IAM Audit Logs | Service account access and permission events |
    | Google Cloud API Metrics | Security Command Center API usage |

    **Sample Success Log**

    ```text theme={null}
    INFO  GCP_SCC_CONNECTOR  Authentication successful for organization_id=123456789012
    INFO  GCP_SCC_CONNECTOR  Retrieved Security Command Center findings successfully
    ```

    **Sample Error Log**

    ```text theme={null}
    ERROR GCP_SCC_CONNECTOR  Permission denied while accessing Security Command Center findings
    ERROR GCP_SCC_CONNECTOR  Invalid service account JSON or malformed private key
    ```

    **Recommended Log Levels**

    | Log Level | Usage |
    | :- | :- |
    | INFO | Successful authentication and data retrieval |
    | WARN | Partial data retrieval or delayed API response |
    | ERROR | Authentication failure, permission issue, invalid organization ID, or API failure |
  </Accordion>

  <Accordion title="🛑 Security & Access Best Practices">
    Follow these recommendations to maintain a secure and compliant Google Cloud Security Command Center (GCP SCC) integration with AirMDR.

    **✅ Do**

    * Use a dedicated Service Account for the AirMDR integration.
    * Grant only the minimum IAM permissions required (principle of least privilege).
    * Store the Service Account JSON securely in an encrypted secrets manager or credential vault.
    * Rotate Service Account keys periodically according to your organization's security policy.
    * Enable Multi-Factor Authentication (MFA) for privileged Google Cloud accounts.
    * Regularly review IAM roles and remove unnecessary permissions.
    * Monitor Google Cloud Audit Logs for authentication and permission changes.
    * Validate the integration after updating IAM roles or rotating credentials.
    * Keep the Security Command Center API enabled and accessible.
    * Immediately revoke compromised or unused Service Account keys.

    **❌ Don't**

    * Don't share the Service Account JSON file over email, chat, or unsecured channels.
    * Don't commit Service Account keys to source code repositories.
    * Don't assign excessive permissions such as **Owner** or **Editor** unless absolutely necessary.
    * Don't reuse the same Service Account across multiple unrelated applications.
    * Don't leave unused Service Account keys active.
    * Don't disable audit logging for Service Account activities.
    * Don't expose Organization IDs or sensitive credentials in public documentation or screenshots.
    * Don't hardcode credentials in scripts or configuration files.
    * Don't ignore authentication or permission-related errors during integration validation.
    * Don't skip periodic access reviews and credential rotation.
  </Accordion>

  <Accordion title="👉 Support & Maintenance">
    * 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
    * 🔁 Rotate credentials regularly.
    * 🔄 Reconnect in AirMDR when secrets are changed.
  </Accordion>

  <Accordion title="🛑 Data Flow & Security">
    **Data Exchanged**

    | Data Type | Description |
    | :- | :- |
    | Security findings | Findings generated by Google Cloud Security Command Center. |
    | Organization metadata | Organization-level identifier used to scope the integration. |
    | Authentication token | Token generated using the service account JSON. |

    **Security Considerations**

    * Authentication is performed using a Google Cloud service account.
    * API communication uses Google Cloud HTTPS endpoints.
    * Store the service account JSON securely.
    * Rotate the JSON key based on the organization’s credential rotation policy.
    * Revoke unused keys immediately.

    **Ports and Endpoints**

    | Type | Value |
    | :- | :- |
    | Protocol | HTTPS |
    | Port | 443 |
    | API Endpoint | `https://securitycenter.googleapis.com` |
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.