Skip to main content Accessibility Help Accessibility Feedback
Console Logo

Security

Risk Overview
Threats
Vulnerabilities
Compliance
Assets
Findings
Sources
Posture Management

Google SecOps
reCAPTCHA
Model Armor
Web Security Scanner
Risk Manager
Binary Authorization
Advisory Notifications
Access Approval
Managed Microsoft AD

Sensitive Data Protection
Data Loss Prevention
Certificate Authority Service
Key Management
Certificate Manager
Secret Manager

Console & APIs Access Policy
Chrome Enterprise Premium
Policy Troubleshooter for Chrome Enterprise Premium
Identity-Aware Proxy
VPC Service Controls
Access Context Manager
Marketplace

Findings

Overall, are you satisfied with SCC?

Filter findings on IP range

You can now use the new inIpRange function to filter findings based on whether they contain or do not contain an IPv4 or IPv6 IP address within a specified CIDR range.
For example: contains(connections, inIpRange(source_ip, "192.0.2.0/24")). Learn more
Query preview
state="ACTIVE" AND NOT mute="MUTED"

Last 7 days
Press Option+F1 for Accessibility Options.
1
state="ACTIVE"

Quick filters

State

Category

  • 3
  • 3
  • 2
  • 2
  • 2
  • 2
  • 1
  • 1
  • 1
  • 1

Finding class

  • 9
  • 7
  • 5
  • 0
  • 0
  • 0
  • 0
  • 0
  • 0

Project ID

  • 12
  • 6
  • 3
  • 0
  • 0
  • 0
  • 0

Resource type

  • 9
  • 6
  • 4
  • 2
  • 0
  • 0
  • 0
  • 0
  • 0
  • 0

Severity

  • 9
  • 6
  • 6
  • 0
  • 0

Source display name

  • 9
  • 7
  • 5
  • 0

Cloud provider

  • 21

Findings query results

Category Severity Attack exposure score Event time Create time Finding class Resource display name Resource path
Private Google access disabled Low — Mar 5, 2025, 6:33:48 PM Aug 24, 2024, 3:28:02 AM Misconfiguration default integration-419004
Impact: service API disabled Low — Mar 5, 2025, 5:09:11 PM Mar 5, 2025, 5:09:12 PM Threat integration-419004 integration-419004
Impact: service API disabled Low — Mar 5, 2025, 5:05:43 PM Mar 5, 2025, 5:05:43 PM Threat integration-419004 integration-419004
Impact: service API disabled Low — Mar 5, 2025, 5:03:28 PM Mar 5, 2025, 5:03:29 PM Threat integration-419004 integration-419004
Persistence: IAM anomalous grant High — Mar 5, 2025, 4:15:25 PM Mar 5, 2025, 4:15:25 PM Threat thisisarealcompany.com
Persistence: IAM anomalous grant High — Mar 5, 2025, 4:14:19 PM Mar 5, 2025, 4:14:19 PM Threat thisisarealcompany.com
Admin service account Medium 0 Mar 5, 2025, 4:14:14 PM Jul 16, 2024, 4:34:14 PM Misconfiguration thisisarealcompany.com
Persistence: IAM anomalous grant High — Mar 5, 2025, 4:10:22 PM Mar 5, 2025, 4:10:22 PM Threat thisisarealcompany.com
Primitive roles used Medium 0 Mar 5, 2025, 4:09:52 PM Jul 9, 2024, 4:46:23 PM Misconfiguration thisisarealcompany.com
Private Google access disabled Low — Mar 3, 2025, 8:17:36 PM Jul 19, 2024, 12:49:49 PM Misconfiguration default integration-1-429916
Instance OS login disabled Medium — Mar 3, 2025, 8:17:36 PM Mar 3, 2025, 8:22:59 PM Misconfiguration key-logger integration-419004
Compute project wide SSH keys allowed Medium 0 Mar 3, 2025, 8:17:36 PM Mar 3, 2025, 8:23:00 PM Misconfiguration key-logger integration-419004
Compute Secure Boot disabled Medium 0 Mar 3, 2025, 6:35:47 PM Mar 3, 2025, 6:35:48 PM Misconfiguration key-logger integration-419004
Public IP address High 0 Mar 3, 2025, 6:35:47 PM Mar 3, 2025, 6:35:48 PM Misconfiguration key-logger integration-419004
Persistence: new geography Low — Mar 3, 2025, 6:22:11 PM Mar 3, 2025, 6:22:11 PM Threat thisisarealcompany.com
Primitive roles used Medium 4.6 Mar 3, 2025, 6:22:06 PM Jul 9, 2024, 5:08:12 PM Misconfiguration integration-419004 integration-419004
Unused IAM role High — Mar 1, 2025, 3:00:00 AM Oct 29, 2024, 8:36:13 PM Vulnerability integration-1-429916 integration-1-429916
Service agent granted basic role High — Mar 1, 2025, 3:00:00 AM Oct 29, 2024, 8:36:13 PM Vulnerability integration-1-429916 integration-1-429916
Service agent granted basic role High — Mar 1, 2025, 3:00:00 AM Oct 29, 2024, 10:29:47 PM Vulnerability integration-419004 integration-419004
Unused IAM role High — Mar 1, 2025, 3:00:00 AM Nov 5, 2024, 4:33:52 PM Vulnerability integration-419004 integration-419004
IAM role has excessive permissions High — Mar 1, 2025, 3:00:00 AM Oct 29, 2024, 10:29:47 PM Vulnerability integration-419004 integration-419004
Rows per page:
30
1 – 21 of 21
Please contact your network administrator for further assistance.
Logging
Solutions
See all search results
Notifications (G then N)
Help (G then H)
Google Cloud Setup
APIs & Services
Billing
IAM & Admin
Marketplace
Compute Engine
Kubernetes Engine
Cloud Storage
BigQuery
VPC Network
Cloud Run
SQL
Google Maps Platform
Security
Cloud overview
Show Logging navigation menu (visual change only)
Search
Sensitive Data Protection
Certificate Authority Service
Console & APIs Access Policy
Chrome Enterprise Premium
Policy Troubleshooter for Chrome Enterprise Premium
thisisarealcompany.com
Show Security navigation menu (visual change only)
Search
This service is available for Security Command Center Enterprise MultiCloud
No findings selected
No findings are selected
Column display options
Go to the previous finding
Go to the next finding

Persistence: new geography

15 of 21
SUMMARY
SOURCE PROPERTIES (8)
JSON

What was detected

State
Active
state
Severity
Low
severity
Event time
March 3, 2025 at 6:22:11 PM GMT-5
event_time
Create time
March 3, 2025 at 6:22:11 PM GMT-5
create_time
Principal email
bucky.bennett@thisisarealcompany.com
access.principal_email
Caller IP
2a0e:4005:1002:ffff:185:40:4:92
access.caller_ip
Caller IP geo region code
NO
access.caller_ip_geo.region_code
User agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0,gzip(gfe),gzip(gfe)
access.user_agent
Service name
cloudresourcemanager.googleapis.com
access.service_name
Method name
SetIamPolicy
access.method_name
Offending access grants
iam_binding

Affected resource

Resource display name
thisisarealcompany.com
resource.display_name
Resource full name
//cloudresourcemanager.googleapis.com/organizations/1085577742955
resource.name
Resource type
google.cloud.resourcemanager.Organization
resource.type
Cloud provider
Google Cloud
resource.cloudProvider
Security contacts
None
contacts.security
Technical contacts
None
contacts.technical

Security marks

No marks

Related links

MITRE ATT&CK method
MITRE Link
Logging URI
Cloud Logging Query Link

Detection service

Finding canonical name
organizations/1085577742955/sources/8135267868135745055/locations/global/findings/c6a7b86dd194460fa22993b61b8bff5c
canonical_name
Finding class
Threat
finding_class
Source display name
Event Threat Detection
parent_display_name
Category
Persistence: new geography
category