Annotate assets with security marks

Security marks are unique to Security Command Center and let you add business context to assets to identify additional information, such as priority, access level, sensitivity classifications, policy application, or integration with your workflow.

After you annotate assets with security marks, you can search, select, or filter assets using these security marks. You can view marks in the Security Command Center API and the Google Cloud console.

Security marks on assets are separate from security marks on findings. If you add a mark to an asset, Security Command Center doesn't automatically add the mark to findings for that asset.

Add or update security marks only on assets that are supported by Security Command Center. For a list of supported assets, see Supported asset types in Security Command Center.

To set security marks on findings, see Annotate findings with security marks.

Security marks are processed during batch scans—which run twice daily for Security Command Center Premium and Enterprise and once every other day for Security Command Center Standard—and not in real time. There may be a delay of 12 to 24 hours before security marks are processed and enforcement policies that resolve or reopen findings are applied.

Security marks are different than labels and tags

Labels and tags are similar kinds of metadata that you can use with Security Command Center, but they have a slightly different use and permissions model than security marks.

Labels are user-level annotations that are applied to specific resources and are supported across multiple Google Cloud products. Labels are primarily used for billing accounting and attribution.

There are two types of tags in Google Cloud:

  • Network tags are user-level annotations, specific to Compute Engine resources. Network tags are primarily used to define security groups, network segmentation, and firewall rules.

  • Resource tags are key-value pairs that can be attached to an organization, folder, or project. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag.

To read or update labels and tags, you need permissions on the underlying resource. Security Command Center ingests labels and tags as part of the resource attributes. When you post-process list API results, you can search for specific labels, tags, keys, and values.

You can add security marks to all resources that are supported by Security Command Center, including all asset types.

Required roles

To get the permissions that you need to add or change security marks on assets, ask your administrator to grant you the Asset Security Marks Writer (securitycenter.assetSecurityMarksWriter) IAM role on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

This role doesn't include permissions to access the underlying resource.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level that you're granted access for. To learn more about Security Command Center roles, see Access control.

Add security marks to assets in the console

To add security marks to assets in the console, follow these steps:

  1. In the Google Cloud console, go to the Assets page of Security Command Center.

    Go to Assets

  2. From the project selector, select the project, folder, or organization that contains the assets you need to mark.

  3. On the assets display that appears, select the checkbox for each asset that you want to mark.

  4. Click Set Security Marks.

  5. In the Security Marks dialog that appears, click Add mark.

  6. Specify one or more security marks by adding Key and Value items.

    For example, if you want to mark projects that are in a production stage, add a key of "stage" and a value of "prod". All selected projects then have the new mark.stage: prod, which you can use to filter them.

  7. To edit an existing mark, update text in the Value field. You can delete marks by clicking the trash icon next to the mark: .

  8. When you're finished adding marks, click Save.

The mark now applies to the asset you selected. By default, the Assets table shows marks in a column.

For information about dedicated asset marks for Security Health Analytics detectors, see the following section Manage policies.

Filter assets by security mark

To filter assets by security mark on the Assets page, use the Filter field. For example, if the security mark key is stage and value is dev, add the following statement to the Filter field:

Security marks:stage=dev

For more information, see Filter assets.

Manage policies

You can set marks on assets to explicitly include or exclude those resources from specific policies. To exclude an asset from a Security Health Analytics detection policy, add the security mark allow_finding-type. For example, to exclude an asset from the SSL_NOT_ENFORCED detector, use the security mark allow_ssl_not_enforced:true. This security mark gives you granular control over each resource and detector.

For more information about using security marks in Security Health Analytics, see Marking assets with marks.

To suppress findings directly instead of marking underlying assets, you can manually or programmatically mute individual findings or create mute rules that automatically mute current and future findings based on filters you define. For more information, see Mute findings in Security Command Center.

What's next