Software vulnerabilities are weaknesses that can either cause an accidentalsystem failure or result in malicious activity. For more information, seeVulnerability reports.

This document describes how to set up your VMs using VM Manager andview the vulnerability reports for your operating systems.

Before you begin

• ReviewOS Config quotas.
• Set upVM Manager.
• If you haven't already, set upauthentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

     gcloudinit

     If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.
  2. Set a default region and zone.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

  gcloudinit

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

Supported operating systems

For the full list of operating systems and versions for which you can getvulnerability reports using VM Manager, seeOperating system details.

Required roles and permissions

To get the permissions that you need to view vulnerability reports, ask your administrator to grant you the following IAM roles on the project:

• To view vulnerability reports using the gcloud CLI or API:OS Config Vulnerability Report Viewer (roles/osconfig.vulnerabilityReportViewer)
• To view vulnerability reports using the Google Cloud console:
  • OS Config Vulnerability Report Viewer (roles/osconfig.vulnerabilityReportViewer)
  • OS Inventory Viewer (roles/osconfig.inventoryViewer)
• To view CVE information in theVM instance details dialog on the Patch page:
  • Patch Deployment Viewer (roles/osconfig.patchDeploymentViewer)
  • Patch Job Viewer (roles/osconfig.patchJobViewer)

For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

In addition to these roles, to access Compute Engine resources by usingthe Google Cloud console, you must have a role that contains thecompute.projects.get permission on the project.

View vulnerability reports

To view vulnerability reports, you can use any of the following options:

• Use theGoogle Cloud console, gcloud CLI or API.
• If you are a Security Command Center premium tier user, use theSecurity Command Center dashboard.
• UseCloud Asset Inventory.

View vulnerability report using the gcloud CLI or API

Use one of the following methods to view vulnerability reports for your VMs.

View vulnerability reports using the Security Command Center dashboard

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.

Security Command Center is Google Cloud's centralized vulnerability and threat reportingservice.

If you are a Security Command Centerpremium tier user, you canaccess vulnerability report data for the operating systems that arerunning on VMs across your organization. On theFindings page in theSecurity Command Center dashboard, you can review theCommon Vulnerabilities and Exposures (CVE) IDs for vulnerabilities that areclassified asHIGH orCRITICAL severity.

For information about using the Security Command Center dashboard to access and reviewoperating system vulnerability data, seeVM Manager.

View vulnerability reports data from Cloud Asset Inventory

OS inventory management stores and forwards inventory and vulnerability report data toCloud Asset Inventory. Cloud Asset Inventory is ametadata inventory service that allows you to view, monitor, and analyze assetsacross Google Cloud.From Cloud Asset Inventory, you can poll the information and view changes in the data.

To access OS inventory and vulnerability report data from Cloud Asset Inventory, you need tocomplete the following setup:

• Set upVM Manager.
• On your Google Cloud project, enable theCloud Asset Inventory API, the Google Cloud CLI, andassign permissions.

For more information, seeViewing VM Manager data.

What's next

• Learn more aboutOS inventory management.