Google Security Command Center in Tenable One Open Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

You are leveraging the Tenable One Open Connector to ingest asset and vulnerability data from Google Security Command Center (SCC) into Tenable Exposure Management. Google SCC is the built-in security and risk service in Google Cloud that aggregates vulnerability, misconfiguration, and threat findings across your cloud environment.

This purpose-built path normalizes your Google Cloud exposure alongside the rest of your attack surface, so you can prioritize, track remediation, and score exposure consistently.

Prerequisites

Before you begin, make sure you have the following:

Requirement	Details
Tenable Exposure Management access	A user account with the Connector Manager or Administrator role.
Google Cloud access	Google SCC enabled at the organization or project level.
Google Cloud service account	A service account with the Security Center Admin Viewer role, and a JSON key file downloaded to a secure local location.
Export format	A CSV or Excel (.xlsx) file produced from the Google SCC API data. For more information, see Pull Your Google SCC Data.
Asset type decision	Determine whether your targets are Devices, Containers, or Resources (Cloud). You cannot change the asset type after you set up the connector. Create a separate connector for each asset type if you need more than one.

Pull Your Google SCC Data

To bring Google SCC data into Tenable Exposure Management, first export your Google SCC assets and findings by using one of the following methods:

• Call the Google SCC REST API.

• Use the Export option in the Google SCC user interface.

Then, upload the exported file or pull it from a supported cloud storage.

Authenticate to the Google SCC API

Before you export your data, create a Google Cloud service account with access credentials, and grant it the required Security Command Center permissions. Use the following Google documentation:

• To create a service account and its access credentials, see Create access credentials.

• For the required Security Command Center permissions, see IAM for organization-level activations.

Key Fields Available in the Google SCC API

The following table lists the key fields that the Google SCC REST API returns for assets and findings.

Google SCC API Field	Object	Description
asset.securityCenterProperties.resourceName	Asset	Full Google Cloud resource path. The canonical unique identifier for the asset.
asset.securityCenterProperties.resourceDisplayName	Asset	Human-readable display name of the asset.
asset.securityCenterProperties.resourceType	Asset	Google Cloud resource type string, for example, google.compute.Instance or google.cloud.storage.Bucket.
asset.createTime	Asset	ISO 8601 timestamp of when Google SCC first observed the asset.
asset.resourceProperties.id	Asset	Numeric Compute Engine instance identifier (Devices only).
asset.securityCenterProperties.resourceParentDisplayName	Asset	Display name of the parent resource, used as the container image path (Containers only).
finding.description	Finding	Human-readable description of the security finding.
finding.vulnerability.cve.id	Finding	CVE identifier when the finding is associated with a known CVE.
finding.createTime	Finding	ISO 8601 timestamp of when the finding was first created in Google SCC.
finding.eventTime	Finding	ISO 8601 timestamp of the most recent event associated with the finding.

Tip: For the mapping in Map Google SCC Fields to Tenable Exposure Management to work cleanly, use a consistent asset identifier. Make sure that securityCenterProperties.resourceName or resourceDisplayName matches how assets appear in your inventory. For Compute Engine instances, using the instance name portion of resourceName (the last segment after the final slash) improves asset deduplication.

Google SCC API Reference

You pull all data from two Google SCC REST API endpoints, one for assets and one for findings. Both require a Bearer token from your Google Cloud service account.

• Base URL: https://securitycenter.googleapis.com/v1

• Authentication: Authorization: Bearer <access_token>

• Required OAuth 2.0 scope: https://www.googleapis.com/auth/cloud-platform

API Call	Fields and Objects Returned	Notes
GET /{parent}/assets	asset.securityCenterProperties, asset.resourceProperties, asset.createTime, asset.updateTime, asset.iamPolicy, asset.securityMarks	Returns the asset inventory for the given parent. Use fieldMask to limit the response size. Paginate with nextPageToken.
GET /{parent}/sources/-/findings	finding.name, finding.description, finding.severity, finding.state, finding.mute, finding.category, finding.findingClass, finding.createTime, finding.eventTime, finding.vulnerability, finding.canonicalName, finding.externalUri, finding.sourceProperties, finding.securityMarks, finding.compliances	Using sources/- returns findings from all sources. Filter by asset type or finding class with the filter query parameter.

Set the {parent} path parameter to your Google Cloud organization, folder, or project:

• Organization level (recommended): organizations/{organization_id}

• Folder level: folders/{folder_id}

• Project level: projects/{project_id}

The connector accepts CSV, Excel (.xlsx), or ZIP files. Save or convert your Google SCC export to one of these formats before you upload it. To automate ongoing ingestion, write the file to a supported cloud storage on a schedule, and then configure the connector to pull from it.

For more information about the Google SCC REST API, see the following Google Cloud documentation:

• List assets in the Google SCC REST API reference

• List findings in the Google SCC REST API reference

• Google SCC findings concepts

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library page appears.

3. In the search box, type the name of the connector (i.e.,Open Connector). Alternatively, locate the connector in the Custom section.

   

4. On the Tenable One Open Connector tile, click Connect.

   The connector configuration options appear.

Configure the Connector

On the Connector Details page, configure the connector to upload your Google SCC export or to pull it from a supported cloud storage.

1. (Optional) In the Connector's Name box, type a descriptive name for the connector, for example, Google SCC – Devices – [Org Name].

2. (Optional) In the Description box, type a description that reflects the source data, for example, Compute Engine findings from Google Security Command Center.

3. In the Data pulling configuration section, select a data source option:

   • Static file upload: Select this option to manually upload a single CSV, Excel, or ZIP file. This option is recommended for initial setup.

   • Automated Pull from Cloud Storage: Select this option to establish a continuous data pipeline from your cloud storage. This option is recommended for ongoing sync.

Option A: Static File Upload

To upload the export file manually:

1. In the Data pulling configuration section, select Static file upload.

2. Click Upload file, and then select the CSV or Excel (.xlsx) file that you exported from Google SCC.

3. Wait for the file preview to load.

4. Continue to Set the Data Update Mode and Retention.

Option B: Automated Pull from Cloud Storage

For automated pulls, grant Tenable Exposure Management read access to the Amazon S3 bucket that holds your Google SCC export file. You can use one of two authentication methods.

To configure the automated Amazon S3 pull:

1. In the Data pulling configuration section, select Automated Pull from Cloud Storage (S3).

2. In the Authentication method section, select ARN & External ID or Access Key & Secret Key.

   • If you select the ARN & External ID method, complete the following configurations in your Amazon S3 console:

     1. Navigate to IAM > Policies > Create Policy > Visual Editor.

     2. From the Service drop-down, select S3.

     3. From the Actions allowed drop-down, select the following permissions:

        • ListBucket

        • GetObject

     4. In the Resources section:

        1. For ListBucket, add the Amazon Resource Name (ARN) for the bucket: arn:aws:s3:::YOUR_BUCKET_NAME

        2. For GetObject, add the ARN for the objects: arn:aws:s3:::YOUR_BUCKET_NAME/*

     5. Click Next.

     6. On the Review policy page, type a Name, for example, S3ConnectorReadAccess, and a Description for the policy.

     7. Review the Summary.

     8. Click Create Policy.

     9. Navigate to IAM > Roles > Create Role > AWS account.

     10. In the Account ID field, type the following Tenable account identifier:

         012615275169

     11. Select the Require External ID check box.

     12. In the text box, type the value of your external identifier.

         Important: The external identifier must follow the AWS AssumeRole API constraints: a length of 2 to 1224 characters, and only alphanumeric characters (A-Z, a-z, 0-9) and the following characters: = , . @ : / - _. Unsupported characters can cause the AssumeRole call to fail.

     13. Paste this value into the Connector text box.

     14. Make sure the Require MFA check box is cleared.

     15. Click Next: Permissions.

     16. Attach the policy you created, for example, S3ConnectorReadAccess.

     17. Continue through the wizard and review the settings.

     18. Create the role.

     19. Copy the ARN and External ID to a safe location. You need them to configure the connector.

   • If you select the Access Key & Secret Key method, complete the following configurations in your Amazon S3 console:

     1. Log in to the AWS console with the target account credentials.

     2. Navigate to IAM > Users.

     3. Select the IAM user with the appropriate permissions.

     4. Navigate to the Security Credentials tab.

     5. In the Access Keys section, click Create access key.

        The Create access key wizard appears.

     6. In the Use case section, select the Third-party service radio button.

     7. Click Next.

     8. In the Description tag value text box, type a descriptive tag for the key.

     9. Click Create access key.

     10. Copy the Access Key and Secret Key to a safe location. You need them to configure the connector.

3. After you generate the required authentication values, complete the connector configuration in Tenable Exposure Management:

   • For the ARN & External ID method, fill in the External ID, Role ARN, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • For the Access Key & Secret Key method, fill in the Access Key, Secret Key, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • (Optional) Fill in the File Pattern, for example, *.csv or scc_assets_*.xlsx.

Set the Data Update Mode and Retention

To complete the data configuration:

1. In the Asset Retention box, type the number of days after which Tenable Exposure Management removes assets. The default is 460 days.

   Tip: To learn more, see How does Asset Retention work in the Tenable One Open Connector?.

2. In the Data Update Mode section, select how the connector processes future data syncs:

   • Override data (Full Fetch): Every new file sync fully overrides the data ingested from the previous sync. Use this mode to replace all existing asset records and findings on each sync.

   • Update data (Incremental Fetch): Every new file sync updates the existing set of data after an initial full sync. This mode processes only the assets and findings updated since the previous sync.

   Tip: For active-finding exports (filter=state="ACTIVE"), Tenable recommends Override data (Full Fetch). Any finding that Google SCC sets to INACTIVE is absent from the next export, so Tenable Exposure Management transitions it to Fixed automatically. To learn more about sync modes, see Manage Data Sources and Update Modes in Tenable One Open Connector.

3. In the Test connectivity section, click Test Connectivity. Tenable Exposure Management validates the credentials and the accessibility of the file path. You must pass this test before you can create the connector.

   Important: If you change the credentials or remap a file, you must test the connectivity again before you can save the connector.

4. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.

5. Click File Preview to view the first 100 rows of the file.

6. Click Next to proceed to asset type selection and field mapping.

7. From the Asset type drop-down, select the category that matches your data:

   • Select Devices for Compute Engine instances (google.compute.Instance).

   • Select Containers for container images (google.compute.Image, google.containerregistry.Image).

   • Select Resources (Cloud) for all other resource types, such as App Engine, Cloud SQL, Google Kubernetes Engine (GKE) clusters, Identity and Access Management (IAM), and storage buckets.

   Important: You cannot change the asset type after you save the connector. Create a separate connector for each asset type.

8. Click Next.

   Note: This selection defines the mapping attributes available in the next step.

Map Google SCC Fields to Tenable Exposure Management

After you upload the file, Tenable Exposure Management displays a field mapping screen with a preview of your data. Use the following tables as a reference. Each table covers one asset type and includes both the asset-level and finding-level mappings in a single view.

The tables list only fields with a direct, single-source mapping. Tenable Exposure Management handles fields that use conditional fallback logic or that combine multiple sources automatically. These fields include asset name, IP addresses, tags, severity score, and finding state, and they do not require manual configuration.

Deduplication Settings

In the deduplication section, set the primary identifier to the field mapped to the asset identifier:

• Devices: Use asset.securityCenterProperties.resourceName, mapped internally to Asset Name.

• Containers: Use asset.securityCenterProperties.resourceName, mapped internally to Container Name.

• Resources (Cloud): Use asset.securityCenterProperties.resourceName, mapped to Asset External Identifier.

Tip: To learn about the expected behavior and logic rules for how Tenable Exposure Management maps source file columns, see Tenable One Open Connector Mapping .

Review and Save

To review and save the connector:

1. Review the field mapping preview to confirm that the data parses correctly.

2. Spot-check two or three rows to verify that the asset identifier field resolves to recognizable resource names.

3. Click Save & Sync.

   Tenable Exposure Management begins processing the file. Depending on the file size, ingestion can take a few minutes.

Validate the Data in Tenable Exposure Management

After the sync completes, confirm that Tenable Exposure Management ingested your Google SCC data correctly.

To validate the data:

1. In Tenable Exposure Management, navigate to the Assets page.

2. In the Filters section, under Custom, click the connector name.

   The asset list updates to show only assets from the selected connector.

   

3. Confirm that assets of the correct type (Devices, Containers, or Resources (Cloud)) appear.

4. Click an asset to view Asset Details, and confirm that the Created Date aligns with the createTime value from the Google SCC API response.

5. Navigate to the Findings page, and filter by the connector name to view all imported Google SCC findings.

6. For CVE-backed findings, confirm that the CVE field is populated and that the finding description is present.

Common Discrepancies to Expect

• CVSSv3 score absent on some findings: Google SCC findings that are not CVE-backed, such as misconfigurations and posture violations, do not carry a CVSSv3 score. In these cases, Tenable Exposure Management derives a numeric score from the Google SCC severity value: CRITICAL to 10, HIGH to 7, MEDIUM to 5, and LOW to 3.

• Finding title uses parent display name instead of CVE identifier: For non-CVE findings, the title is set to finding.parentDisplayName, for example, Security Health Analytics. This behavior is expected for misconfigurations and threat detections.

• Asset not matched to existing inventory: If a Compute Engine instance already exists in Tenable Vulnerability Management through Tenable Nessus, it can appear as a separate asset until the deduplication logic correlates the records. Consistent hostnames across tools improve match rates.

Keep Your Data Current

Choose the method that fits your operational needs.

Method	Cadence	How
Manual re-upload	As needed	Call the Google SCC API again, export a fresh file, and re-upload it through the connector.
Cloud storage automation	Scheduled	Run a scheduled script that calls the Google SCC API and writes the output to a supported cloud storage. Tenable Exposure Management pulls the file on your sync schedule.