Annotate findings with security marks

Security marks are unique to Security Command Center and let you add business context to findings, such as priority, access level, or sensitivity classifications.

After you annotate findings with a security marks, you can search, select, or filter findings using the security marks. You can view marks in the Security Command Center API and the Google Cloud console.

Security marks are processed during batch scans—which run twice daily for Security Command Center Premium and Enterprise and once every other day for Security Command Center Standard—and not in real time. There may be a delay of 12 to 24 hours before security marks are processed and enforcement policies that resolve or reopen findings are applied.

Security marks on assets are separate from security marks on findings. If you add a security mark to an asset, Security Command Center doesn't automatically add the mark to findings for that asset.

To set security marks on assets, see Annotate assets with security marks.

Required roles

To get the permissions that you need to add or change security marks on findings, ask your administrator to grant you the Finding Security Marks Writer (securitycenter.findingSecurityMarksWriter) IAM role on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

The IAM roles for Security Command Center can be granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, and security sources depends on the level that you're granted access for. To learn more about Security Command Center roles, see Access control.

Add security marks in the console

You can add security marks to findings by using the console. After adding security marks, you can filter findings in the Query editor panel.

To add security marks using the console, do the following:

  1. Go to the Security Command Center Findings page in the console.

    Go to the Findings page

  2. Select the project or organization you want to review.

  3. In the Findings query results panel, select one or more findings to add a security mark to by selecting their checkboxes.

  4. Click Set security marks.

  5. In the Security Marks dialog that appears, click Add mark.

  6. Specify the security mark Key and Value.

    For example, if you want to mark findings that are part of the same incident, add a key of incident-number and a value of 1234. Each finding then has the new mark.incident-number: 1234.

  7. To edit an existing mark, update text in the Value field.

  8. To delete marks, click the trash icon next to the mark: .

  9. When you're finished adding marks, click Save.

Filter findings by security mark

To filter findings by security mark on the Findings page, add the security_marks.marks attribute to the query statement in the Query editor. For example, if the security mark key is stage and the value is dev, add the following clause to the Query editor:

AND security_marks.marks.stage="dev"

For more information, see Query findings in the console.

Manage policies

To suppress findings, you can mute individual findings or create mute rules that automatically mute current and future findings based on filters you define. For more information, see Mute findings in Security Command Center.

Muting findings is the recommended method when you don't want to review findings for projects that are isolated or fall within acceptable business parameters.

Alternatively, you can set marks on assets to explicitly include or exclude monitored resources from specific detection policies. For instructions to use dedicated security marks for Security Health Analytics detectors, see Manage policies in Annotate assets with security marks.

What's next