Overview of exporting Security Command Center data

Standard-legacy, Standard, Premium, and Enterprise service tiers

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

This page describes two methods for exporting Security Command Center data using the Google Cloud console:

• One-time exports for existing findings, assets, and security marks
• Continuous exports that automatically export new findings to Pub/Sub

Exportable Security Command Center data includes assets, findings, and security marks.

You can also export findings to BigQuery or Cloud Logging. For more information, see the following resources:

• Stream findings to BigQuery for analysis
• Bulk export findings to BigQuery
• Export logs to Logging

Note: We don't recommend using the API to export findings programmatically. Because API list calls return up to 1,000 findings per call and require you to manage pagination, they are inefficient for large data exports. Instead, use one of the methods described in this document. Each method lets you filter the data that you export.

One-time exports

One-time exports let you manually transfer and download current and historical findings and assets.

For findings, you can use the Google Cloud console to transfer data in JSON, JSONL, or CSV format to a Cloud Storage bucket. You can also download a limited number of findings to your workstation in CSV format.

For assets, you can download the data from the Google Cloud console to your local workstation as a CSV file.

Before you begin

Before you initiate a one-time export, you must obtain specific Identity and Access Management (IAM) roles and permissions and familiarize yourself with data residency limitations.

Required roles

To get the permissions that you need to perform one-time exports, ask your administrator to grant you the following IAM roles on the project, folder, or organization that you want to export data from:

• Security Center Admin Viewer (roles/securitycenter.adminViewer)
• Export findings to a Cloud Storage bucket: Storage Admin (roles/storage.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to perform one-time exports. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to perform one-time exports:

• securitycenter.assets.group
• securitycenter.assets.list
• securitycenter.findings.group
• securitycenter.findings.list
• securitycenter.sources.get
• securitycenter.sources.list
• securitycenter.userinterfacemetadata.get
• Perform exports for organization-level activations: resourcemanager.organizations.get
• Perform exports for project-level activations: resourcemanager.projects.get

You might also be able to get these permissions with custom roles or other predefined roles.

For more information about Security Command Center roles, see Access control.

Data residency limitations for one-time exports

You cannot include any of your data that is subject to data residency control in the filter of a one-time export to Cloud Storage.

If you specify a property that contains controlled data in the finding filter, Security Command Center returns an error message when you attempt the export.

Export data using the Google Cloud console

Using the Google Cloud console, you can do the following:

• Export findings to a Cloud Storage bucket
• Export findings to a CSV file
• Export assets to a CSV file

Export findings to a Cloud Storage bucket

This section describes how to export Security Command Center data to a Cloud Storage bucket. When you click Export on the Findings page in the Google Cloud console, Security Command Center automatically gets credentials or permissions to write to the Cloud Storage bucket.

You can export a JSON file, a JSONL file, or a CSV file to an existing Cloud Storage bucket or create a bucket during the export process. You can export all current findings, or select the filters you want to use before you export.

Note: You can't export findings to a Cloud Storage bucket that has a retention policy set.

1. In the Google Cloud console, go to the Security Command Center Findings page.

   Go to Findings

2. Select a project, folder, or organization.

3. Select the findings that you need to export by applying filters to the findings query. For more information about creating filters, see Find and view specific findings.

4. When you're done creating a filter, click Export, and then, under One-time, click Cloud storage.

5. On the Export page, configure the export:

   1. In the Export to section, specify the following fields:
      1. In the Project name field, specify the project that contains the Cloud Storage bucket.
      2. In the Export path field, which only appears after you specify a project, click Browse.
      3. On the Select object panel, select an existing Cloud Storage bucket or create a storage bucket.
      4. After you select or create a bucket, under Filename, enter a name for the export file.
      5. Click Select.
   2. In the Export criteria section, specify the following fields:
      1. Click Group results by, and select how you want to group the export data.
      2. Click in the Format field and select JSON, JSONL, or CSV.
      3. Click in the Time range field and select the time period from which to export findings.
   3. In the Findings query section, confirm the query appears as you expect.
   4. Below the query, confirm that the number and type of matching findings are what you expect.
   5. Click Export.

   If you selected an existing file in the bucket, the Confirm Overwrite dialog displays.

   • To overwrite the existing file, click Confirm.
   • To change the file you're writing to, click Cancel, then click Browse in the Export path box and select or create a different file.

The configured data is saved to the Cloud Storage bucket that you specified.

Download exported data from a Cloud Storage bucket

To download the exported JSON, JSONL, or CSV data, perform the following steps:

1. Go to the Storage browser page in the Google Cloud console.

   Go to Storage browser

2. Select your project, and then click the bucket to which you exported data.

3. Select the checkbox next to the export file, and then click Download.

4. On the Save File dialog, select the location where you want to save the file, and then click Save.

The JSON, JSONL, or CSV file is downloaded to the location that you specified.

Export findings to a CSV file

To configure the export, you can filter findings by category, severity, and other properties. All findings that match the filter are included in the CSV file.

You can download up to 1,000 findings directly to your workstation. If the number of findings exceeds 1,000, you are prompted to refine your query to get fewer results. Alternatively, you can export the data to a Cloud Storage bucket.

Note: The system exports finding records with a default set of columns, which might not match what you see in the console. That is, hiding or displaying columns doesn't change which columns are exported. Similarly, changing the number of rows displayed per page—which you can do in the Google Cloud console—has no effect on the exported content.

To download finding data to a CSV file, follow these steps:

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select a project, folder, or organization.

3. Optional: To refine the selection of findings that you want to export, Find and view specific findings.

4. Click Export > CSV. The CSV file is downloaded to your local workstation.

Export assets to a CSV file

You can download asset data to a CSV file from the Assets page in the Google Cloud console.

To download asset data to a CSV file, follow these steps:

1. In the Google Cloud console, go to the Assets page of Security Command Center.

   Go to Assets

2. Select a project, folder, or organization.

3. Optional: Use the Quick filters panel or the Filter field of the asset results panel to select the assets you need to export. For more information about filtering assets, see Filter assets.

4. Click Export > Download CSV. The data for the assets in the results panel are downloaded to your workstation.

Continuous exports

Continuous exports simplify the process of automatically exporting Security Command Center findings into Pub/Sub. When new findings are written, they are automatically exported to designated Pub/Sub topics in near real time, letting you integrate them into your existing workflow.

To learn more about Pub/Sub, see What is Pub/Sub?.

Before you begin

Before you initiate a continuous export, you must obtain specific IAM roles and permissions and familiarize yourself with both data residency limitations and Pub/Sub compatibility.

Required roles

To get the permissions that you need to create and manage continuous exports, ask your administrator to grant you the following IAM roles on the project, folder, or organization that you want to export data from:

• View continuous exports: Security Center Admin Viewer (roles/securitycenter.adminViewer)
• View, create, and manage continuous exports: Security Center Admin Editor (roles/securitycenter.adminEditor)

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to create and manage continuous exports. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to create and manage continuous exports:

• View or publish Pub/Sub topics:
  • pubsub.topics.publish
  • pubsub.topics.list
• View the continuous exports page:
  • securitycenter.notificationconfig.get
  • securitycenter.notificationconfig.list
• Manage continuous exports:
  • securitycenter.notificationconfig.create
  • securitycenter.notificationconfig.update
  • securitycenter.notificationconfig.delete

You might also be able to get these permissions with custom roles or other predefined roles.

For more information about Security Command Center roles, see Access control.

Data residency and continuous exports

If data residency is enabled for Security Command Center, the configurations that define continuous exports to Pub/Sub—notificationConfig resources—are subject to data residency control and are stored in a Security Command Center location that you select.

To export findings in a Security Command Center location to Pub/Sub, you must configure the continuous export in the same Security Command Center location as the findings.

Because the filters that are used in continuous exports can contain data that is subject to residency controls, make sure you specify the correct location before you create them. Security Command Center does not restrict which location you create exports in.

Continuous exports are stored only in the location in which they are created and cannot be viewed or edited in other locations.

After you create a continuous export, you can't change its location. To change the location, you need to delete the continuous export and recreate it in the new location.

To learn how to use Security Command Center when data residency is enabled, see Security Command Center regional endpoints.

Compatibility with Pub/Sub message storage policies

Pub/Sub lets you set a message storage policy. This policy ensures that Pub/Sub stores and processes messages only in the set of Google Cloud regions that you specify, regardless of where the publish or subscribe requests originate.

However, continuous exports are incompatible with the enforceInTransit option of message storage policies. When you configure continuous exports, don't choose a Pub/Sub topic that has a message storage policy with enforceInTransit enabled; such a topic might not receive finding notifications from Security Command Center.

For more information, see Message storage policy overview.

Create a continuous export to Pub/Sub

Continuous exports let you automate the export of all future findings to Pub/Sub or create filters to export future findings that meet specific criteria. You can filter findings by category, source, asset type, security marks, severity, state, and other variables.

Your organization can create a maximum of 500 continuous exports.

To create an export for Pub/Sub, do the following:

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select a project, folder, or organization.

3. In the Findings query results field, select the findings to export by using either of the following methods:

   • By clicking Add Filter to select the properties of the findings you need to export.

     The Add filter menu lets you choose supported finding attributes and values.

     1. In the Select filter menu, select a finding attribute or type its name in the Search finding attributes box. A list of the available sub-attributes displays.
     2. Select a sub-attribute. A selection field displays where you can build the query statement using the sub-attribute you selected, a query operator, and one or more values for the sub-attribute.

     3. Select the operator and one or more values for the sub-attribute from the panel. For more information about query operators and functions that they use, see Query operators in the Add filters menu.

        If you want to start over, click Reset.

     4. Click Apply.

        The menu closes and your query is updated.

     5. Repeat until the findings query contains all the attributes you want.

   • By manually coding the finding query in the query editor. You can use standard SQL operators AND,OR, equals (=), has (:), and not (-) to specify the finding properties and values of the findings you need to export.

     As you type in your query, an autocomplete menu appears, where you can select filter names and functions.

     For example, the following query mutes low-severity and medium-severity anomalous IAM grant findings in prod-project, and excludes resource types where the name has the substring compute:

     severity="LOW" OR severity="MEDIUM" AND category="Persistence:
     IAM Anomalous Grant" AND resource.project_display_name="prod-project"
     AND -resource.type:"compute"
     

     For more examples on filtering findings, see Filtering notifications.

4. Review the resulting query for accuracy. To make changes, delete or add properties and filter values as needed.

5. Click Refresh matching findings. A table displays findings that match your query. For more information about querying findings, see Edit a findings query in the Google Cloud console.

6. Click Export, and then, under Continuous, click Pub/Sub.

7. Review your filter to ensure it's correct and, if necessary, return to the Findings page to modify it.

8. Under Continuous export name, enter a name for the export.

9. Under Continuous export description, enter a description for the export.

10. Under Export to, select a project for your export. You can't create a project on this page. To create a new project, see Creating a project.

11. Under Pub/Sub topic, select the topic where you want to export findings. To create a topic, do the following:

    1. Select Create a topic.

    2. Enter a Topic ID, and then select other options as needed:

       1. Learn about Creating and managing schemas.
       2. Learn about using customer-managed encryption keys (CMEK) with Pub/Sub.

    3. Click Create Topic.

12. Click Save. You see a confirmation and are returned to the findings page.

13. Follow the guide to create a subscription for your Pub/Sub topic.

The Pub/Sub export configuration is complete. To publish notifications, a service account is created for you in the form of [e-mail]. This service account is automatically granted the roles/securitycenter.notificationServiceAgent role at the organization level. This service account role is required for notifications to function.

Test continuous exports

To confirm that an export is working, perform the following steps to toggle findings between active and inactive states.

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Click Edit query. The Query editor opens.

3. Edit the query so that both so that both active and inactive findings are displayed. The following query omits the state property to display all findings except those that are muted:

   NOT mute="MUTED"

   1. If necessary, use the Query editor to re-enter filter variables that match the export filter you're testing.
   2. Select a finding and then click Change Active State > Inactive.
   3. Select the finding again that you marked inactive, click Change Active State > Active. A notification is sent for the newly active finding.
   4. Go to the Pub/Sub page in the Google Cloud console.

   Go to Pub/Sub

   1. In the list of topics, click the name of your topic.
   2. Go to the Messages tab and select your subscription from the list to see the finding notification.
   3. Optional: Click Pull to refresh messages.

Manage continuous exports

To view, edit, or delete exports, do the following:

1. In the Google Cloud console, go to the Security Command Center Settings page.

   Go to Settings

2. Select a project, folder, or organization.

3. Select Continuous exports. You see a list of continuous exports for your project, folder, or organization.

On the Continuous exports page in Settings, you can create, view, edit, and delete continuous exports.

View related findings

To see findings that match an export filter, do the following:

On the Continuous exports page, next to the name of an export, select More , and then click View related filters.

The Findings page loads with findings that match the export filter.

Edit continuous exports

1. On the Continuous exports page, click the name of the export you want to view or modify, or click More .
2. Select Edit.
3. Enter a new description, change the project that exports are saved to, or enter a new Pub/Sub topic.
4. When done, click Save.

Note: You can't change the name of an export or modify an export filter. To use a different name or filter, you must create a new export.

Delete continuous exports

1. On the Continuous exports page, click the name of the export you want to delete.
2. Click Delete.
3. In the dialog, click Delete. The export is deleted.

What's next

• Learn more about finding notifications.
• Learn how to enable real-time chat notifications.