Overview

The GCP Security Command Center (SCC) integration polls the Security Command Center API to ingest:

  • Vulnerability findings from Security Health Analytics and Web Security Scanner
  • Threat detection findings from Event Threat Detection and Container Threat Detection
  • Misconfigurations and policy violations
  • Custom findings published by partner integrations

Prerequisites

  • SCC enabled at the organization level (Standard or Premium tier).
  • Permission to grant the Security Center Findings Viewer role at the organization.
  • The numeric Organization ID of your GCP organization.

Step 1: Find your organization ID

  1. Open the Google Cloud Console.
  2. Go to IAM & Admin → Settings, or run gcloud organizations list.
  3. Note the numeric organization ID (for example, 123456789012). The form expects it in the format organizations/123456789012.

Step 2: Create a service account

  1. In a project of your choice, go to IAM & Admin → Service Accounts → Create service account.
  2. Name it atatus-scc and click Create and continue.
  3. Click Done (organization-level roles are granted in the next step).
  4. Open the service account → Keys tab → Add Key → Create new key → JSON and download the file.

Step 3: Grant the service account SCC access

  1. Open IAM & Admin → IAM and switch the scope to your Organization (top breadcrumb).
  2. Click Grant access, paste the service account email, and assign:
    • Security Center Findings Viewer (roles/securitycenter.findingsViewer)
  3. Click Save.

Step 4: Enable the Security Command Center API

  1. In the project that hosts the service account, go to APIs & Services → Library.
  2. Search for and enable Security Command Center API.

Step 5: Connect GCP Security Command Center in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the GCP Security Command Center card and click Connect.
  3. Fill in the form:
Field Description Example
Service Account JSON Paste the entire JSON key from Step 2. { "type": "service_account", ... }
Organization ID Organization resource name. organizations/123456789012
Project ID Project that hosts the service account. security-hub-project
Poll Interval (minutes) How often to fetch new findings. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The GCP Security Command Center card shows Configured.
  • SCC findings appear in Security → Cloud SIEM → Audit Logs → Events with source gcp_scc.