Google SCC Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Google Security Command Center (SCC) is the security and risk management service of Google Cloud, which identifies vulnerabilities and misconfigurations in your Google Cloud projects.

Connector Details

Tenable Exposure Management ingests Google Cloud assets and Security Command Center vulnerability and misconfiguration findings through API.

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

1. Confirm that Security Command Center is activated on your Google Cloud organization, folder, or project, on either the Standard or the Premium tier.

2. Confirm that you can grant Identity and Access Management (IAM) roles at the level that you want to sync, and that you can create a service account and a JSON key in Google Cloud.

3. Create a Service Account

4. Grant the IAM Roles

5. Enable the Required APIs

6. Create and Download the JSON Key

Create a Service Account

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

2. In the project picker at the top of the page, select the project or organization that hosts the service account. Any project works, and many organizations use a dedicated security or operations project.

   Note: The project that holds the service account does not limit what the service account can read. The service account reads data only where you grant it the roles.

3. Click Create Service Account.

4. In the Service account name text box, type a name, for example tenable-scc-connector.

5. In the Service account description text box, type a description, for example Service account used by Tenable to read Google SCC findings and assets.

6. Click Create and Continue.

7. Skip the optional role grants on this screen. You grant the roles in Grant the IAM Roles.

8. Click Done.

Grant the IAM Roles

Grant the following two read-only roles to the service account. These roles are the minimum that the connector needs to list projects, read assets, and read findings.

The level where you grant the roles determines which projects Tenable can sync. Roles that you grant on an organization or a folder apply to every folder and project inside it.

To grant the IAM roles:

1. In the Google Cloud console, go to IAM & Admin > IAM.

2. In the resource picker, select the organization, folder, or project that you want to sync.

3. Click Grant Access.

4. In the New principals text box, type the email address of the service account, for example [email protected].

5. Add the Security Center Findings Viewer role.

6. Add the Cloud Asset Viewer role.

7. Click Save.

8. Repeat these steps for each folder or project that you want to add.

Enable the Required APIs

Enable the following APIs on the project that holds the service account.

To enable the required APIs:

1. In the Google Cloud console, go to APIs & Services > Library.

2. Search for each API.

3. Click Enable. If the API already shows API Enabled, continue to the next API.

Create and Download the JSON Key

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

2. Click the service account that you created.

3. Select the Keys tab.

4. Click Add Key > Create new key.

5. Select JSON, and then click Create. The key file downloads to your computer.

6. Store the key file in a safe location. You need it to configure the connector.

   Note: The key file is a credential. Tenable recommends that you treat it like a password. If the key is exposed, delete it on the Keys tab and create a new one.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library page appears.

   

3. In the search box, type the name of the connector.

4. On the tile for the connector, click Connect.

   The connector configuration options appear.

Configure the Connector

To configure the connector:

1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

2. (Optional) To use a preconfigured on-prem connector to connect to this connector, from the Gateway drop-down, select the on-prem connector you want to use for the connector. Otherwise, select Don't use gateway.

   Note: For information about configuring a gateway, see Tenable On-Prem Connector.

3. In the Service Account Key File section, click Upload Service Account JSON File, and then select the JSON key that you downloaded in Create and Download the JSON Key.

4. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. Below are the configurations relevant to this connector.

   • Select the Pull all projects checkbox to sync every active project that the service account can access. Each sync lists the available projects, so Tenable Exposure Management picks up new projects automatically. This checkbox is selected by default.

   • If you clear Pull all projects, from the Projects drop-down, select one or more projects to sync. Each project appears as <project ID> (<parent>), where the parent is the organization or folder. The drop-down lists only the active projects that the service account can access.

   • From the Resource types to fetch drop-down, select the groups of Google Cloud resource types to sync. Each label shows the Tenable asset classes of the group in brackets. All eight groups are selected by default, and you must select at least one group.

     Group	Asset classes	Examples
     Compute	Device, Resource	VM instances, disks, snapshots, images, Cloud Run, Cloud Functions, App Engine, instance groups
     Kubernetes & Containers	Container Image, Container Repository, Resource	Artifact Registry images and repositories, Container Registry images, GKE clusters and node pools
     Identity & IAM	Account, Role, Resource	Service accounts, service account keys, custom roles, IAM policies, workload identity pools, API keys, secrets, KMS key rings and keys
     Storage	Resource	Cloud Storage buckets, log buckets
     Database	Resource	BigQuery datasets and tables, Cloud SQL instances and backups, Firestore, Spanner, Dataform, Dataplex
     Networking	Resource	VPC networks, subnets, firewalls, firewall policies, routers, routes, addresses, forwarding rules, VPN, DNS zones, SSL policies
     AI & ML	Resource	Vertex AI endpoints, models, datasets, and indexes, Dialogflow, Discovery Engine, notebooks
     Org & Project settings	Resource	Compute project settings, Cloud Build triggers, billing information, log sinks, monitoring dashboards, Security Command Center service, organization policy settings

     Note: Both assets and findings are fetched only for the asset classes of the selected groups. When you clear a group, Tenable Exposure Management no longer fetches its assets or its findings. The Project asset and project-level findings are always included when at least one group is selected. For the asset classes and the Google Cloud types in each group, see Asset Types per Group and Finding Resource Types per Group.

   • Select the Mark muted findings as FIXED in Tenable checkbox to show findings that are muted in Google as Fixed in Tenable Exposure Management. This checkbox is selected by default. When you clear it, muted findings show as Active.

   • From the Archiving statuses drop-down, select the statuses for which you want Tenable Exposure Management to archive assets. DELETED is selected by default. One status list applies to all asset classes, so DEACTIVATED archives both disabled service accounts and disabled custom roles.

     Status	Applies to	When Google reports
     STOPPED	VM instances (Device)	The VM is not running, which includes the Google statuses TERMINATED, STOPPING, SUSPENDING, and SUSPENDED.
     DEACTIVATED	Service accounts and service account keys (Account), custom roles (Role)	The service account or key is disabled, or the custom role is in the DISABLED stage.
     DELETED	Custom roles (Role)	The custom role is deleted. Google retains deleted custom roles for a short time before it removes them.

     Note: STOPPED archives VMs that still exist in Google, and a stopped VM can start again. If you select STOPPED, Tenable Exposure Management does not show stopped VMs or their findings.

   • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

     Tip: For more information, see Asset Retention.

5. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.
   

   • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.
     

   • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.
     

     

6. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.

7. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.
   

8. To confirm the sync is complete, do the following:

   • Navigate to the Connectors page and monitor the connector's status. Sync is complete once the connector status is Connected.

   • View the sync logs for the connector to monitor the logs for a successful connection.

Google SCC in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

1. In Tenable Exposure Management, navigate to the Assets page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

   

   The asset list updates to show only assets from the selected connector.

3. Click on any asset to view Asset Details.

Locate Connector Weaknesses in Tenable Exposure Management

As the connector discovers weaknesses, Tenable Exposure Management ingests those weaknesses for reporting.

To view weaknesses by connector: 

1. In Tenable Exposure Management, navigate to the Weaknesses page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view weaknesses.

   

   The weaknesses list updates to show only weaknesses from the selected connector.

3. Click on any weakness to view Weakness Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

1. In Tenable Exposure Management, navigate to the Findings page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings.

   

   The findings list updates to show only assets from the selected connector.

3. Click on any asset to view Finding Details.

Data Mapping

Tenable Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Tenable Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Tenable Exposure Management.

Finding Status Mapping

Finding Severity Mapping

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip: To learn more about data deduplication and uniqueness criteria, See Third-Party Data Deduplication in Tenable Exposure Management.

The uniqueness criteria for this connector are as follows:

Support and Expected Behavior

Support Limitations and Expected Behavior

This section outlines any irregularities, expected behaviors, or limitations related to integration of the connector and Tenable Exposure Management. It also highlights details about ingested and non-ingested data to clarify data handling and functionality within this integration.

API Endpoints in Use

Security Command Center API v2, Cloud Asset Inventory API v1, and Cloud Resource Manager API v3. All three APIs use global endpoints, so you do not need to type a URL or select a region.

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and the Google SCC platform. Use the same projects and the same resource types on both sides.

Asset Data Validation

Objective: Ensure the number of resources in Google SCC aligns with the number of assets displayed in Tenable Exposure Management.

In Google SCC:

1. In the Google Cloud console, select the project in the resource picker.

2. Go to Security > Asset Inventory, and then select the Resource tab.

3. In the Resource type filter, select the asset types of the groups that you selected in Resource types to fetch, and also select cloudresourcemanager.Project. See Asset Types per Group.

4. Note the total number of resources.

5. Repeat these steps for each project that the connector syncs, and then add up the totals.

In Tenable Exposure Management:

1. Locate your connector assets.

2. Compare the total number of assets between Google SCC and Tenable Exposure Management.

Expected outcome: The total numbers returned in Google SCC and Tenable Exposure Management should match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

• The resource type is not in a group that you selected in Resource types to fetch.

• The resource is in a project that the connector does not sync.

• The resource is a Folder or an Organization, which the connector does not fetch.

• The asset was archived, either because it did not return in the connector's last sync or because its Google status matches a status that you selected in Archiving statuses.

  Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.

• The resource was deleted in Google, and the asset aged out of Tenable Exposure Management.

Finding Data Validation

Objective: Ensure the number of findings in Google SCC aligns with the number of findings in Tenable Exposure Management.

In Google SCC:

1. In the Google Cloud console, select the project in the resource picker.

2. Go to Security > Findings.

3. Clear all filters, and remove any grouping.

4. In the Finding class filter, select Vulnerability and Misconfiguration.

5. In the Resource type filter, select the types of the groups that you selected in Resource types to fetch. See Finding Resource Types per Group.

6. In the State filter, select Active. If Mark muted findings as FIXED in Tenable is selected, also exclude muted findings.

7. Note the total number of findings.

8. Repeat these steps for each project that the connector syncs, and then add up the totals.

In Tenable Exposure Management:

1. Locate your connector findings.

2. Filter by the Active state.

3. Compare the total number of findings between Google SCC and Tenable Exposure Management.

Expected outcome: The total numbers returned in Google SCC and Tenable Exposure Management should match.

If a finding is missing from Tenable Exposure Management or no longer active, check the following conditions:

• The finding class is not Vulnerability or Misconfiguration.

• The resource type of the finding is not in a group that you selected in Resource types to fetch.

• The finding is on a Folder or on the Organization, which the connector does not fetch.

• The finding is on a deleted resource. Google marks the finding INACTIVE, and it has no asset in Tenable Exposure Management.

• The asset of the finding was archived, so Tenable Exposure Management removed the finding instead of marking it as Fixed.

  Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.

• The finding is marked as Fixed and appears under the Fixed state on the Findings screen, because the finding is muted in Google and Mark muted findings as FIXED in Tenable is selected.

Asset Types per Group

The following table lists the Cloud Asset Inventory asset types in each group, in the format that the Google Cloud console uses. The connector fetches only the types of the groups that you select. cloudresourcemanager.Project is always included.

Finding Resource Types per Group

Security Command Center uses its own resource type names. The connector fetches findings only for the types of the groups that you select. google.cloud.resourcemanager.Project, which covers project-level findings, is always included.