---
title: "Google Security Command Center"
slug: "google-security-command-center"
updated: 2025-03-27T14:48:17Z
published: 2025-03-27T14:48:17Z
canonical: "docs.databee.buzz/google-security-command-center"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Security Command Center

Security Command Center is Google Cloud's centralized vulnerability and threat reporting service. Security Command Center helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities and threats; and helping you mitigate and remediate risks.

For more information refer to [Google Cloud Command Center official documentation](https://cloud.google.com/security-command-center/docs).

**Integration Method**: API

**Tables**: Compliance Finding (2003), Detection Finding (2004), Vulnerability Finding (2002)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Findings | Retrieves a collection of findings that have been detected across all sources within an organization in Google Security Command Center (SCC). |

This integration supports the following versions.

| Google Security Command Center API Version | v2 |
| --- | --- |

> [!NOTE]
> **Note:**
> 
> As of this document preparation, latest release was on [March 14, 2025](https://cloud.google.com/security-command-center/docs/release-notes#March_14_2025).

## Prerequisites

- The user should have access to the Google Cloud Platform (GCP) console and ensure Google Security Command Center (SCC) is activated at the organization level.
- The user should generate or access service account credentials to authenticate REST API calls. To create a service account, open the Service accounts page in GCP, select or create a project, and click Create service account.
- The user should have access to the DataBee console.

## Configuration Overview

1. Generate a service account with the required scopes and its private key.
2. Add the [Security Command Center (SCC) data feed](/user-manual/docs/google-security-command-center#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **Security Command Center (SCC) Parameter** |
| --- | --- |
| Client Email | Service account email id |
| Admin Email | Domain admin email id |
| Private Key | [Private Key](/user-manual/docs/google-security-command-center-mar2025#getting-client-id-and-private-key) |

## Google Security Command Center Configuration

### Setting Up the New Project

1. Login to your [Google Cloud Platform console](https://console.cloud.google.com/).
2. On your console, click on your organization name in the Navigation bar. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-c3f93b1c.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
3. On “Select a resource” window click on **NEW PROJECT**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-vsu9mlq1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
4. On the “New Project” window, enter your project name and click on **Create**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-qydsa1ue.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)

### Setting Up the service account

Perform the following steps to set up Google Workspace credentials on your Google console:

1. Navigate to **console.cloud.google.com**, and log into the Google account where you want to set up your Google Workspace credentials. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-s9g4qqh0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
2. Navigate to **APIs & Services** > **Enabled APIs & services**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-2ffk2306.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
3. Click on the search bar. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-oqn95lj2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
4. Search for the Admin SDK API. Select the **Admin SDK API**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-7fbeam8j.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
5. In “Admin SDK API”, select the **ENABLE** button to enable the Admin SDK API. Making calls to this API lets you view and manage resources such as user, groups, and audit and usage reports of your domain. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-2lrycmlb.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
6. Navigate to **IAM & Admin** > **Service Accounts**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-9gagzh0c.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
7. In the **Service Accounts** page, select **CREATE SERVICE ACCOUNT** > **Service Accounts**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-j947hac8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
8. In “Create service account” page, perform the following steps:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-m4wcxals.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  1. Name your service account and select **CREATE AND CONTINUE**.
  2. Grant your service account access to a project.
  3. Select **Continue**.
  4. Grant users access to your service account.
  5. Select **DONE**.

### Plan activation of Google Security Command Center

1. Login to your [Google Cloud Platform console](https://console.cloud.google.com/).
2. Select the organization that you want to enable Security Command Center for, and then click **Select**.
3. Click on **Security** > **Risk Overview**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-g877igbd.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
4. In **Select tier**, select a tier. Click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-na3errsd.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
5. Click On **UPDATE YOUR TIER**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-l71ywduc.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
6. After ensuring that the Google SCC service is activated on an organization-level, we need to get the service account's credentials for accessing the service via REST calls.

### Getting Client ID and Private Key

1. In Credentials, navigate to your new service account name, and select your new service account name.
2. In the “Service account details” page for your new service account, perform the following steps:
  1. Navigate to the Unique ID, and copy the contents of the **Unique ID**.
  2. This is also your **Client ID**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-rvn6ybfb.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  3. Navigate to the **KEYS** tab.
  4. Select **ADD KEY** > **Create new key**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-tmkde7rh.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  5. Select the **JSON** key type and click **CREATE**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-t1gtyd0t.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  6. Save the key type as JSON file to your selected directory. Below is the sample private key. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-dupjsksa.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)

> [!NOTE]
> **Note:**
> 
> Your new public/private key pair is generated and downloaded to your machine, and it serves as the only copy of this key. Kindly store it in a secure place.

### Setting Up Domain Wide Delegation

1. Navigate to **admin.google.com**.
2. Navigate to **Security** > **Access and data control** > **API controls**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-xgwjj9ru.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
3. In “API Controls” page, navigate to **Domain wide delegation**, and select **MANAGE DOMAIN WIDE DELEGATION**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-jesddcpc.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
4. In “Domain-wide Delegation” page, select **Add new** to add a new client ID. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-ypwy0xif.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
5. In the “Add a new client ID” window, perform the following steps:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-d33ebf48.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  1. In the ‘Client ID’ field, paste the Client ID that is present under **client_id** key of the private key file of the service account**.**
  2. In the ‘OAuth scopes (comma-delimited)’ field, add the following read-only scope to fetch users, deleted users, roles, and mobile devices data:
    1. https://www.googleapis.com/auth/cloud-platform

### Assign IAM Roles to Service Account

To assign roles to the newly created service account, follow below steps:

1. Go to the Google Cloud Console and open [Google Cloud Console](https://console.cloud.google.com/).
2. In the left-hand navigation pane, click on **IAM & Admin**.
3. Then select **IAM**.
4. Ensure you have selected the correct organization from the project/organization selector at the top of the page.
5. Click on the **Add** button at the top of the IAM page. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-w45oulyy.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
6. Click on **GRANT ACCESS**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-ffym524t.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
7. In the ‘New members’ field, enter the email address of the service account you created.
8. In the ‘Select a role’ dropdown, choose the appropriate role(s) you want to assign to the service account. You can search for roles or browse through the categories. The roles mentioned below are the minimum required roles for accessing Google SCC API.
  - Organization Admin
  - Security Center Admin Viewer
9. Click the **SAVE** button to apply the role to the service account.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-c2aq5dp8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-zay4fv5e.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
2. Search for the **Google Security Command Center** option using the search bar in the “Add new data feed” page.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-skjvxo4a.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
3. Click on the **API Ingest** option for the collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-rzehpuvt.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-0q3zmt8o.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
5. In the configuration details dialog, enter the following:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-security-command-center-mar2025-image-fv5elwlk.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A08%3A57Z&se=2026-10-30T13%3A08%3A57Z&sr=c&sp=r&sig=cAC47BJgHrKNLxFPCyBus1b3RAaZHf13U%2Fp24PFpseM%3D)
  - Authorization Method: Google OAuth2
  - API Base URL: replace the <instance> placeholder with value based on the location of your GCP account as listed below.
    - global: *securitycenter*
    - me-central-2: *securitycenter.me-central2.rep*
  - Organization ID: enter the org id. Refer to [link](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id) for more information.
  - Token URL: enter https://oauth2.googleapis.com/token
  - Private Key: paste the private key inside the Service Account JSON file downloaded earlier.
  - Client Email: enter the email address during the service account creation process.

Example:
    - Correct Format: MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAA
    - Incorrect Format: -----BEGIN PRIVATE KEY----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAA\n-----END PRIVATE KEY-----\n
  - Admin Email: enter the email address of the user for which the application is requesting delegated access. If there is no [domain-wide authority delegated](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority) to the service account, enter the same email as entered in the Client Email field.
6. Click **Submit**.

## Troubleshooting Tips

- If you’re facing **invalid_client** or **unauthorized_client** issues, this might be due to incorrect service account credentials. Ensure the private key is pasted correctly. Since you cannot view the key after the first time, re-create the service account key, paste it into a text editor to verify there are no spaces or unexpected characters, and reconfigure the DataBee feed.
- If you are facing a **403** response code, this might be due to missing permissions. Ensure that the service account has the required Google Security Command Center roles and permissions as per the steps mentioned above.