Security profile groups are containers for security profiles.
They let you bundle security profile types together for easier
management and application to firewall rules. You can create these groups at
either the organization or project level.

Each security profile group can contain up to one security profile of each of
the following types:

- `THREAT_PREVENTION`
- `WILDFIRE_ANALYSIS`
- `URL_FILTERING`

To apply consistent network security policies across your Google Cloud
environment, you can use security profile groups to combine and apply threat
prevention, Advanced malware sandbox (WildFire), and URL
filtering profiles. By grouping these
profiles, you can enforce multiple security checks such as threat prevention,
Advanced malware sandbox, and URL filtering on network traffic through a single firewall
policy rule, ensuring consistent policy enforcement and simplified management.

This document is intended for network administrators and security engineers who
configure network security and firewall policies.

Before you begin, review the concepts in the
[Security profile groups overview](https://docs.cloud.google.com/firewall/docs/about-security-profile-groups.md.txt).

> [!NOTE]
> **Note:** To check the progress of the operations listed on this page, make sure that your user role has the following [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) permissions:
>
> - `networksecurity.operations.get`
> - `networksecurity.operations.list`

## Before you begin

- You must [enable](https://console.cloud.google.com/apis/library/networksecurity.googleapis.com)
  the [Network Security API](https://docs.cloud.google.com/firewall/docs/reference/network-security/rest.md.txt)
  in your project.

- To run the `gcloud` command-line examples in this guide,
  install the [gcloud CLI](https://docs.cloud.google.com/sdk/docs.md.txt).

- Create the security profiles that you need to add to the security profile group.

### Roles

To get the permissions that you need to create
security profile groups, ask your administrator to grant you the necessary
[Identity and Access Management (IAM) roles](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt)
on your organization or project. For more information about granting roles, see
[Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

## Create a security profile group

Create a security profile group to bundle one or more security profiles into one
resource for easier management and application to firewall rules.

Each security profile group can contain up to one security profile of each of
the following types:

- `THREAT_PREVENTION`
- `WILDFIRE_ANALYSIS`
- `URL_FILTERING`

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles on your organization or project.

**Permissions**

- `networksecurity.securityProfileGroups.create`

**Roles**

- Compute Network Admin (`roles/compute.networkAdmin`)
- Security Profile Admin (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups

### Console

> [!NOTE]
> **Note:** If your Google Cloud project is in a data residency zone (DRZ) in the Kingdom of Saudi Arabia (KSA) or India, you can't view, list, create, update, or delete project-level security profiles or security profile groups by using the Google Cloud console. To manage project-level security profiles and security profile groups in KSA and India, use the gcloud CLI or the API.

1. In the Google Cloud console, go to the **Security profiles** page.


   [Go to Security profiles](https://console.cloud.google.com/net-security/security-profiles/profiles/list)

   <br />

2. Click **Open project picker** and select your organization or project.

3. Select the **Security profile groups** tab.

4. Click **Create profile group**.

5. Enter a name in the **Name** field.

   > [!CAUTION]
   > Avoid sensitive information, such as personally identifiable information (PII) or security data, in the security profile group name.

6. Optional: Enter a description in the **Description** field.

7. To create a security profile group for Cloud Next Generation Firewall Enterprise, in
   the **Purpose** section, select **Cloud NGFW Enterprise**.

8. Add one or more security profiles to the group:

   - To add a threat prevention profile, select **Threat prevention profile**.
   - To add an Advanced malware sandbox profile, select **Advanced malware sandbox (WildFire) profile**.
   - To add a URL filtering profile, select the **URL filtering profile**.
9. Click **Create**.

### gcloud

To create a security profile group, use the
[`gcloud network-security security-profile-groups create` command](https://docs.cloud.google.com/sdk/gcloud/reference/network-security/security-profile-groups/create.md.txt):

```
gcloud network-security security-profile-groups create NAME \
    --organization ORGANIZATION_ID | --project PROJECT_ID \
    --location global \
    [--billing-project BILLING_PROJECT_ID] \
    [--threat-prevention-profile THREAT_SECURITY_PROFILE_URL] \
    [--wildfire-analysis-profile WILDFIRE_SECURITY_PROFILE_URL] \
    [--url-filtering-profile URL_SECURITY_PROFILE_URL] \
    [--description DESCRIPTION]
```

Replace the following:

- `NAME`: the name of the security profile group.

  If you don't specify the name in [the unique URL identifier
  format](https://docs.cloud.google.com/firewall/docs/about-security-profile-groups#specifications),
  you must specify the organization or the project name, and the location.

  > [!CAUTION]
  > Don't include sensitive information such as personally identifiable information or security data in the security profile group name.

- `ORGANIZATION_ID`: the organization ID. Use this flag
  for an organization-level security profile group.

- `PROJECT_ID`: the project ID. Use this flag for a
  project-level security profile group.

- `BILLING_PROJECT_ID`: the billing project ID. Use this
  flag only for organization-level security profile groups.

- `THREAT_SECURITY_PROFILE_URL`: a unique URL
  identifier for a security profile of `THREAT_PREVENTION` type.

- `WILDFIRE_SECURITY_PROFILE_URL`: a unique URL
  identifier for a security profile of `WILDFIRE_ANALYSIS` type. To enable
  Advanced malware sandbox, include the `--wildfire-analysis-profile` flag along
  with a mandatory `--threat-prevention-profile` flag.

- `URL_SECURITY_PROFILE_URL`: a unique URL identifier
  for a security profile of `URL_FILTERING` type.

- `DESCRIPTION`: an optional description for the
  security profile group.

## What's next

- [Manage security profile groups](https://docs.cloud.google.com/firewall/docs/manage-security-profile-groups.md.txt)
- [Create firewall endpoints and endpoint associations](https://docs.cloud.google.com/firewall/docs/configure-firewall-endpoints.md.txt)
- [Manage firewall endpoints and endpoint associations](https://docs.cloud.google.com/firewall/docs/manage-firewall-endpoints.md.txt)