Mute individual findings

This document explains how to statically mute individual findings, unmute them, or mute findings in bulk in Security Command Center.

Required roles

To get the permissions that you need to mute or unmute findings, ask your administrator to grant you the following IAM roles on the organization, folder, or project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Mute an individual finding

You can statically mute an individual finding by using the Google Cloud console, the gcloud CLI, or the Security Command Center API.

Statically muting a finding doesn't affect whether it is active or not. If an active finding is muted, the state attribute remains unchanged: state="ACTIVE". The finding is hidden, but remains active until the underlying vulnerability, misconfiguration, or threat is resolved. In addition, by statically muting a finding, you are overriding any dynamic mute rules that apply to the finding.

Muting a toxic combination finding closes the corresponding toxic combination case.

To mute all future findings that match criteria that you specify, see Manage mute rules.

For sample code to mute a finding, see Mute a finding.

To statically mute an individual finding, click the tab for the procedure that you want to use:

Console

  1. In the Google Cloud console, go to the Security Command Center Findings page.

    Go to Findings

  2. If necessary, select your Google Cloud project or organization.
  3. If you don't see the finding that you need to mute in the Findings query results panel, select the category of the finding in the Category section of the Quick filters panel.
  4. Select the finding that you need to mute. You can select one or more findings.

  5. On the Findings query results action bar, click Mute options, and then select Apply mute override.

    The mute attribute for the selected findings is set to MUTED, and the finding is removed from the Findings query results panel. Alternatively, you can mute a finding from its details panel:

  6. In the Finding query results panel of the Findings page, in the Category column, click the name of an individual finding. The details panel of the finding opens.

  7. Click Take action.

  8. From the Take action menu, select Apply mute override.

    If you select Mute findings like this instead, the Create mute rule page opens where you can create a mute rule for findings of the same type or that include the same Indicator attribute.

gcloud

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. To set a finding's mute state to MUTED, use the set-mute command in the gcloud CLI:

    gcloud scc findings set-mute FINDING_ID \
  --PARENT=PARENT_ID \
  --location=LOCATION \
  --source=SOURCE_ID \
  --mute=MUTED

    Replace the following:

    • FINDING_ID: the ID for the finding you want to mute

      To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings`/5ee30aa342e799e4e1700826de053aa9.

    • PARENT: the parent resource (project, folder, or organization), case-sensitive

    • PARENT_ID: the ID of the parent organization, folder, or project

    • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global

    • SOURCE_ID: the source ID

      For instructions on retrieving a source ID, see Getting the source ID.

Go

import (
	"context"
	"fmt"
	"io"

	securitycenter "cloud.google.com/go/securitycenter/apiv2"
	"cloud.google.com/go/securitycenter/apiv2/securitycenterpb"
)

// setMute mutes an individual finding.
// If a finding is already muted, muting it again has no effect.
// Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
func setMute(w io.Writer, findingPath string) error {
	// findingPath: The relative resource name of the finding. See:
	// https://cloud.google.com/apis/design/resource_names#relative_resource_name
	// Use any one of the following formats:
	//  - organizations/{organization_id}/sources/{source_id}/finding/{finding_id}
	//  - folders/{folder_id}/sources/{source_id}/finding/{finding_id}
	//  - projects/{project_id}/sources/{source_id}/finding/{finding_id}
	// findingPath := fmt.Sprintf("projects/%s/sources/%s/finding/%s", "your-google-cloud-project-id", "source", "finding-id")
	ctx := context.Background()
	client, err := securitycenter.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("securitycenter.NewClient: %w", err)
	}
	defer client.Close()

	req := &securitycenterpb.SetMuteRequest{
		Name: findingPath,
		Mute: securitycenterpb.Finding_MUTED}

	finding, err := client.SetMute(ctx, req)
	if err != nil {
		return fmt.Errorf("failed to set the specified mute value: %w", err)
	}
	fmt.Fprintf(w, "Mute value for the finding: %s is %s", finding.Name, finding.Mute)
	return nil
}

Java


import com.google.cloud.securitycenter.v2.Finding;
import com.google.cloud.securitycenter.v2.Finding.Mute;
import com.google.cloud.securitycenter.v2.SecurityCenterClient;
import com.google.cloud.securitycenter.v2.SetMuteRequest;
import java.io.IOException;

public class SetMuteFinding {

  public static void main(String[] args) throws IOException {
    // TODO: Replace the variables within {}
    // findingPath: The relative resource name of the finding. See:
    // https://cloud.google.com/apis/design/resource_names#relative_resource_name
    // Use any one of the following formats:
    //  - organizations/{org_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //  - folders/{folder_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //  - projects/{project_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //
    String findingPath = "{path-to-the-finding}";

    setMute(findingPath);
  }

  // Mute an individual finding.
  // If a finding is already muted, muting it again has no effect.
  // Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
  public static Finding setMute(String findingPath) throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests.
    try (SecurityCenterClient client = SecurityCenterClient.create()) {

      SetMuteRequest setMuteRequest =
          SetMuteRequest.newBuilder()
              // Relative path for the finding.
              .setName(findingPath)
              .setMute(Mute.MUTED)
              .build();

      Finding finding = client.setMute(setMuteRequest);
      System.out.println(
          "Mute value for the finding " + finding.getName() + " is: " + finding.getMute());
      return finding;
    }
  }
}

Python

def set_mute_finding(finding_path: str) -> None:
    """
      Mute an individual finding.
      If a finding is already muted, muting it again has no effect.
      Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
    Args:
        finding_path: The relative resource name of the finding. See:
        https://cloud.google.com/apis/design/resource_names#relative_resource_name
        Use any one of the following formats:
        - organizations/{organization_id}/sources/{source_id}/finding/{finding_id},
        - folders/{folder_id}/sources/{source_id}/finding/{finding_id},
        - projects/{project_id}/sources/{source_id}/finding/{finding_id}.
    """
    from google.cloud import securitycenter_v2

    client = securitycenter_v2.SecurityCenterClient()

    request = securitycenter_v2.SetMuteRequest()
    request.name = finding_path
    request.mute = securitycenter_v2.Finding.Mute.MUTED

    finding = client.set_mute(request)
    print(f"Mute value for the finding: {finding.mute.name}")
    return finding

REST

In the Security Command Center API, use the findings.setMute method to mute a finding. The request body is an enum that indicates the resulting mute state:

POST https://securitycenter.googleapis.com/v2/PARENT/PARENT_ID/sources/SOURCE_ID/locations/LOCATION/findings/FINDING_ID:setMute

{
  "mute": "MUTED"
}

Replace the following:

  • PARENT: the parent resource (organizations, folders, or projects).
  • PARENT_ID: the ID of the parent organization, folder, or project.
  • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global

  • SOURCE_ID: the numeric ID for the source.

    For instructions on retrieving a source ID, see Getting the source ID.

  • FINDING_ID: the ID for the finding you want to mute.

    To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

After you mute a finding, its mute attribute is set to MUTED.

Unmute individual findings

You can statically unmute an individual finding by using the Google Cloud console, the gcloud CLI, or the Security Command Center API.

Unmuting a finding is useful when you need to prevent a finding from being hidden by an overly broad mute rule, or by a rule that might be too complex to modify to exclude findings you deem important.

Unmuted findings are muted again only if the findings are manually muted. Mute rules created with the gcloud CLI or Security Command Center API won't affect findings unmuted by users.

For sample code to unmute a finding, see Unmute a finding.

Console

To unmute an individual finding using Google Cloud console, click the tab for your service tier:

  1. In the Google Cloud console, go to the Security Command Center Findings page.

    Go to Findings

  2. If necessary, select your Google Cloud project or organization. The Findings page opens with the default query displayed in the Query preview section. The default query filters out muted findings, so you need to edit the query before muted findings appear in the Findings query results panel.
  3. To the right of the Query preview section, click Edit query to open the Query editor.
  4. In the Query editor field, replace the existing mute statement with the following: 
    mute="MUTED"
  5. Click Apply. The findings in the Findings query results panel update to include only muted findings.
  6. If necessary, filter out other muted findings. For example, in the Quick filters panel under Category, select the name of the finding that you need to unmute to filter out all other categories of finding.
  7. Select the finding that you want to unmute. You can select one or more findings.
  8. On the Findings query results action bar, click Mute Options, and then select Apply unmute override. The mute attribute for the selected findings is set to UNMUTED, and the finding is removed from the Findings query results panel. Alternatively, you can unmute a finding from its details panel:
  9. In the Finding query results panel of the Findings page, in the Category column, click the name of an individual finding. The details panel of the finding opens.
  10. Click Take action.
  11. From the Take action menu, select Apply unmute override.

gcloud

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. To set a finding's mute state to UNMUTED, use the set-mute command in the gcloud CLI:

    gcloud scc findings set-mute FINDING_ID \
  --PARENT=PARENT_ID \
  --location=LOCATION \
  --source=SOURCE_ID \
  --mute=UNMUTED

    Replace the following:

    • FINDING_ID: the ID for the finding you want to mute

      To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

    • PARENT: the parent resource (project, folder, or organization ), case-sensitive

    • PARENT_ID: the ID of the parent organization, folder, or project

    • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global

    • SOURCE_ID: the source ID

      For instructions on retrieving a source ID, see Getting the source ID.

Go


import (
	"context"
	"fmt"
	"io"

	securitycenter "cloud.google.com/go/securitycenter/apiv2"
	"cloud.google.com/go/securitycenter/apiv2/securitycenterpb"
)

// setUnmute unmutes an individual finding.
// Unmuting a finding that isn't muted has no effect.
// Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
func setUnmute(w io.Writer, findingPath string) error {
	// findingPath: The relative resource name of the finding. See:
	// https://cloud.google.com/apis/design/resource_names#relative_resource_name
	// Use any one of the following formats:
	//  - organizations/{organization_id}/sources/{source_id}/finding/{finding_id}
	//  - folders/{folder_id}/sources/{source_id}/finding/{finding_id}
	//  - projects/{project_id}/sources/{source_id}/finding/{finding_id}
	// findingPath := fmt.Sprintf("projects/%s/sources/%s/finding/%s", "your-google-cloud-project-id", "source", "finding-id")
	ctx := context.Background()
	client, err := securitycenter.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("securitycenter.NewClient: %w", err)
	}
	defer client.Close()

	req := &securitycenterpb.SetMuteRequest{
		Name: findingPath,
		Mute: securitycenterpb.Finding_UNMUTED}

	finding, err := client.SetMute(ctx, req)
	if err != nil {
		return fmt.Errorf("failed to set the specified mute value: %w", err)
	}
	fmt.Fprintf(w, "Mute value for the finding: %s is %s", finding.Name, finding.Mute)
	return nil
}

Java


import com.google.cloud.securitycenter.v2.Finding;
import com.google.cloud.securitycenter.v2.Finding.Mute;
import com.google.cloud.securitycenter.v2.SecurityCenterClient;
import com.google.cloud.securitycenter.v2.SetMuteRequest;
import java.io.IOException;

public class SetUnmuteFinding {

  public static void main(String[] args) throws IOException {
    // TODO: Replace the variables within {}
    // findingPath: The relative resource name of the finding. See:
    // https://cloud.google.com/apis/design/resource_names#relative_resource_name
    // Use any one of the following formats:
    //  - organizations/{org_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //  - folders/{folder_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //  - projects/{project_id}/sources/{source_id}/locations/{location}/finding/{finding_id}
    //
    String findingPath = "{path-to-the-finding}";

    setUnmute(findingPath);
  }

  // Unmute an individual finding.
  // Unmuting a finding that isn't muted has no effect.
  // Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
  public static Finding setUnmute(String findingPath) throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests.
    try (SecurityCenterClient client = SecurityCenterClient.create()) {

      SetMuteRequest setMuteRequest =
          SetMuteRequest.newBuilder()
              .setName(findingPath)
              .setMute(Mute.UNMUTED)
              .build();

      Finding finding = client.setMute(setMuteRequest);
      System.out.println(
          "Mute value for the finding " + finding.getName() + " is: " + finding.getMute());
      return finding;
    }
  }
}

Python

def set_unmute_finding(finding_path: str) -> None:
    """
      Unmute an individual finding.
      Unmuting a finding that isn't muted has no effect.
      Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE.
    Args:
        finding_path: The relative resource name of the finding. See:
        https://cloud.google.com/apis/design/resource_names#relative_resource_name
        Use any one of the following formats:
        - organizations/{organization_id}/sources/{source_id}/finding/{finding_id},
        - folders/{folder_id}/sources/{source_id}/finding/{finding_id},
        - projects/{project_id}/sources/{source_id}/finding/{finding_id}.
    """
    from google.cloud import securitycenter_v2

    client = securitycenter_v2.SecurityCenterClient()

    request = securitycenter_v2.SetMuteRequest()
    request.name = finding_path
    request.mute = securitycenter_v2.Finding.Mute.UNMUTED

    finding = client.set_mute(request)
    print(f"Mute value for the finding: {finding.mute.name}")
    return finding

REST

In the Security Command Center API, use the findings.setMute method to unmute a finding. The request body is an enum that indicates the resulting mute state:

POST https://securitycenter.googleapis.com/v2/PARENT/PARENT_ID/sources/SOURCE_ID/locations/LOCATION/findings/FINDING_ID:setMute

{
  "mute": "UNMUTED"
}

Replace the following:

  • PARENT: the parent resource (organizations, folders, or projects)
  • PARENT_ID: the ID of the parent organization, folder, or project
  • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global

  • SOURCE_ID: the numeric ID for the source

    For instructions on retrieving a source ID, see Getting the source ID.

  • FINDING_ID: the ID for the finding you want to mute.

    To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

Selected findings are no longer hidden, and the mute attribute for the findings is set to UNMUTED.

Remove a mute state override from individual findings

You apply a mute state override when you intentionally modify a finding's mute state to statically mute or unmute the finding. For example, you might want to apply a mute state override to hide a low-severity finding that is not worth creating a dynamic mute rule for.

You can remove a mute state override from an individual finding by using the Google Cloud console, the gcloud CLI, or the Security Command Center API.

Before removing the mute state override from a finding, understand the following:

  • A finding has a mute state override if it is statically muted or unmuted. You can apply a mute state override to any finding manually or automatically with static mute rules.
  • A mute state override applies to a finding indefinitely and takes priority over any matching mute rules.
  • Removing the mute state override from a finding resets the finding's mute state so that it can be processed by static or dynamic mute rules.
  • Removing the mute state override from a finding is different than unmuting a finding. When you unmute a finding (apply an unmute override), mute rules can't mute that finding until you've manually removed the mute state override.

To remove the mute override from an individual finding, do the following:

Console

  1. In the Google Cloud console, go to the Security Command Center Findings page.

    Go to Findings

  2. Select your Google Cloud project or organization.
  3. To the right of the Query preview section, click Edit query to open the Query editor.
  4. In the Query editor field, replace the existing mute statement with the following: 
    mute="MUTED" OR mute="UNMUTED"
  5. Click Apply. The findings in the Findings query results panel update to include statically muted and unmuted findings.
  6. If necessary, filter out other findings. For example, in the Quick filters panel under Category, select the name of the finding that you need to reset to filter out all other categories of finding.
  7. Select the finding that you want to reset. You can select one or more findings.
  8. On the Findings query results action bar, click Mute Options, and then select Remove mute overrides. The mute attribute for the selected findings is set to UNDEFINED, and the finding is removed from the Findings query results panel. Alternatively, you can unmute a finding from its details panel:
  9. In the Finding query results panel of the Findings page, in the Category column, click the name of an individual finding. The details panel of the finding opens.
  10. Click Take action.
  11. From the Take action menu, select Remove mute overrides.

gcloud

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. To set a finding's mute state to UNDEFINED, use the set-mute command in the gcloud CLI:

    gcloud scc findings set-mute FINDING_ID \
  --PARENT=PARENT_ID \
  --location=LOCATION \
  --source=SOURCE_ID \
  --mute=UNDEFINED

    Replace the following:

    • FINDING_ID: the ID for the finding you want to reset

      To retrieve finding IDs, use the Security Command Center API to list findings. The finding ID is the last part of the canonicalName attribute, for example, projects/123456789012/sources/1234567890123456789/findings/5ee30aa342e799e4e1700826de053aa9.

    • PARENT: the parent resource (project, folder, or organization ), case-sensitive

    • PARENT_ID: the ID of the parent organization, folder, or project

    • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global

    • SOURCE_ID: the source ID

      For instructions on retrieving a source ID, see Getting the source ID.

REST

In the Security Command Center API, use the findings.setMute method to reset the mute state of a finding. The request body is an enum that indicates the resulting mute state:

POST https://securitycenter.googleapis.com/v2/PARENT/PARENT_ID/sources/SOURCE_ID/locations/LOCATION/findings/FINDING_ID:setMute

{
  "mute": "UNDEFINED"
}

Replace the following:

  • PARENT: the parent resource (organizations, folders, or projects)
  • PARENT_ID: the ID of the parent organization, folder, or project
  • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global
  • SOURCE_ID: the numeric ID for the source

Java


import com.google.cloud.securitycenter.v2.Finding;
import com.google.cloud.securitycenter.v2.Finding.Mute;
import com.google.cloud.securitycenter.v2.SecurityCenterClient;
import com.google.cloud.securitycenter.v2.SetMuteRequest;
import java.io.IOException;

public class SetMuteUndefinedFinding {

  public static void main(String[] args) throws IOException {
    // TODO: Replace the variables within {}

    // findingPath: The relative resource name of the finding. See:
    // https://cloud.google.com/apis/design/resource_names#relative_resource_name
    // Use any one of the following formats:
    // - organizations/{organization_id}/sources/{source_id}/finding/{finding_id}
    // - folders/{folder_id}/sources/{source_id}/finding/{finding_id}
    // - projects/{project_id}/sources/{source_id}/finding/{finding_id}
    String findingPath = "{path-to-the-finding}";
    setMuteUndefined(findingPath);
  }

  // Reset mute state of an individual finding.
  // If a finding is already reset, resetting it again has no effect.
  // Various mute states are: MUTE_UNSPECIFIED/MUTE/UNMUTE/UNDEFINED.
  public static Finding setMuteUndefined(String findingPath) throws IOException {
    // Initialize client that will be used to send requests. This client only needs
    // to be created once, and can be reused for multiple requests.
    try (SecurityCenterClient client = SecurityCenterClient.create()) {

      SetMuteRequest setMuteRequest =
          SetMuteRequest.newBuilder()
              .setName(findingPath)
              .setMute(Mute.UNDEFINED)
              .build();

      Finding finding = client.setMute(setMuteRequest);
      System.out.println(
          "Mute value for the finding " + finding.getName() + " is: " + finding.getMute());
      return finding;
    }
  }
}

Mute or reset multiple existing findings

You can perform the following bulk mute operations for multiple existing findings by using either the gcloud scc findings bulk-mute gcloud CLI command, or the bulkMute method of the Security Command Center API:

  • Mute multiple existing findings. Muting existing findings in bulk mutes them statically and overrides any dynamic mute rules that apply to the finding. If you need to mute similar future findings, create a mute rule.

  • Remove the mute state override on multiple existing findings. By removing the mute state override on a finding, you are resetting the mute state from MUTED (statically muted) or UNMUTED (statically unmuted) to UNDEFINED. This capability can be useful if you are migrating from static to dynamic mute rules.

Specify the set of findings that you need to mute by defining a finding filter. Bulk mute filters don't support all finding properties. For a list of unsupported properties, see Unsupported finding properties for mute rules.

If data residency is enabled for Security Command Center, bulk mute operations are limited in scope to the Security Command Center location in which they are executed.

For sample code that mutes findings in bulk, see Bulk mute findings.

To mute or reset findings in bulk, click the tab for the procedure that you want to use:

Console

In the Google Cloud console, you can only bulk mute findings by creating mute rules. In the Google Cloud console, creating mute rules silences existing and future findings.

gcloud

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. To mute or reset multiple findings in bulk, run the gcloud scc findings bulk-mute command:

    gcloud scc findings bulk-mute \
  --PARENT=PARENT_ID \
  --location=LOCATION \
  --filter="FILTER" \
  --mute-state=MUTE_STATE

    Replace the following:

    • PARENT: the scope in the resource hierarchy to which the mute rule applies, organization, folder, or project.
    • PARENT_ID: the numeric ID of the parent organization, folder, or project, or the alphanumeric ID of the parent project.
    • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global.

    • FILTER: the expression you define to filter findings.

      For example, to mute all existing low-severity OPEN_FIREWALL and PUBLIC_IP_ADDRESS findings in the internal-test project, your filter can be "category=\"OPEN_FIREWALL\" OR category=\"PUBLIC_IP_ADDRESS\" AND severity=\"LOW\" AND resource.projectDisplayName=\"internal-test\"".

    • MUTE_STATE: the value that indicates whether the finding is statically muted or not. Valid values are MUTED and UNDEFINED. The value is set to MUTED by default. Only set this value to UNDEFINED if you are resetting the mute state of multiple existing findings.

REST

In the Security Command Center API, use the findings.bulkMute method to mute or reset the mute state of multiple existing findings. The request body contains the expression used to filter findings:

POST https://securitycenter.googleapis.com/v2/PARENT/PARENT_ID/locations/LOCATION/findings:bulkMute

{
  "filter": "FILTER",
  "muteState": "MUTE_STATE"
}

Replace the following:

  • PARENT: the parent resource (organizations, folders, or projects).
  • PARENT_ID: the ID of the parent organization, folder, or project.
  • LOCATION: the Security Command Center location in which to mute or unmute findings; if data residency is enabled, use eu, sa, or us; otherwise, use the value global.

  • FILTER: the expression you define to filter findings.

    For example, to mute all existing low-severity OPEN_FIREWALL and PUBLIC_IP_ADDRESS findings in the internal-test project, your filter can be "category=\"OPEN_FIREWALL\" OR category=\"PUBLIC_IP_ADDRESS\" AND severity=\"LOW\" AND resource.projectDisplayName=\"internal-test\"".

  • MUTE_STATE: the value that indicates whether the finding is muted or not. Valid values are MUTED or UNDEFINED. The value is set to MUTED by default. Only set this value to UNDEFINED if you are resetting the mute state of multiple existing findings.

All existing findings in the resource you select, and which exactly match the filter, are hidden. The mute attribute for the findings is set to MUTED.

Muting findings doesn't change their state. If active findings are muted, they are hidden but remain active until the underlying vulnerabilities, misconfigurations, or threats are resolved.

View muted findings in the Google Cloud console

You can view muted findings in the Google Cloud console by editing the finding query to select findings that include the property value mute="MUTED".

For example, the following findings query displays only active findings that are muted:

state="ACTIVE"
AND mute="MUTED"

To display all active findings, both muted and unmuted, omit the mute attribute from the query entirely:

state="ACTIVE"

By default, the finding query in the Google Cloud console displays only findings that are not muted.

View findings muted by mute rule type

The following sections describe how to query active findings by mute rule type.

For more information on listing specific findings, see Filter findings.

Query findings muted by static mute rules

To display active findings that were muted by a static mute rule after a specified time, use the following query and inspect the muteInitiator attribute to determine if the finding was muted by a static mute rule.

state="ACTIVE" AND
muteInfo.staticMute.applyTime>=TIMESTAMP AND
muteInfo.staticMute.state="MUTED"

Replace the TIMESTAMP with the date and time string that indicates the beginning of the time period you want to query. For information about time formats, see gcloud topic datetimes.

Query findings muted by dynamic mute rules

To display active findings that were muted by a dynamic mute rule after a specified time, use the following query:

state="ACTIVE" AND
muteUpdateTime>=TIMESTAMP AND
contains(muteInfo.dynamicMuteRecords, muteConfig="PARENT_ID/muteConfigs/CONFIG_ID")

Replace the following:

  • TIMESTAMP: the date and time string that indicates the beginning of the time period you want to query. For information about time formats, see gcloud topic datetimes.
  • PARENT_ID: the ID of the parent organization, folder, or project, specified in the format of organizations/123, folders/456, or projects/789.
  • CONFIG_ID: the name of the mute rule. The ID must use alphanumeric characters and hyphens and be between 1 and 63 characters.

For more information about editing finding queries, see Create or edit a findings query in the dashboard.

Stop notifications and exports of muted findings

If you enable finding notifications, new or updated muted findings that match your notification filters are still exported to Pub/Sub.

To stop exports and notifications for muted findings, use the mute attribute to exclude muted findings in your NotificationConfig filter. For example, the following filter only sends notifications for active findings that are not muted or where the mute attribute hasn't been set:

FILTER="state=\"ACTIVE\" AND -mute=\"MUTED\""