gcloud alpha scc findings create - create a Security Command Center finding

gcloud alpha scc findings create(FINDING :--organization=ORGANIZATION--source=SOURCE)--category=CATEGORY--event-time=EVENT_TIME--resource-name=RESOURCE_NAME[--external-uri=EXTERNAL_URI][--location=LOCATION; default="global"][--source-properties=[KEY=VALUE,…]][--state=STATE][GCLOUD_WIDE_FLAG …]

gcloudalphasccfindingscreate`testFinding`--organization=123456--source=5678--state=ACTIVE--category='XSS_SCRIPTING'--event-time=2023-01-11T07:00:06.861Z--resource-name='//cloudresourcemanager.googleapis.com/projects/9876'

Create an ACTIVE findingtestFinding with category: XSS_SCRIPTINGattached to project with project number9876 under organization123456 and source5678 using the full resource name:

gcloudalphasccfindingscreateorganizations/123456/sources/5678/findings/testFinding--state=ACTIVE--category='XSS_SCRIPTING'--event-time=2023-01-11T07:00:06.861Z--resource-name='//cloudresourcemanager.googleapis.com/projects/9876'

Create an ACTIVE findingtestFinding with category:XSS_SCRIPTING attached to project with project number`9876under organization123456, source5678 andlocation=eu:

gcloudalphasccfindingscreate`testFinding`--organization=123456--source=5678--state=ACTIVE--category='XSS_SCRIPTING'--event-time=2023-01-11T07:00:06.861Z--resource-name='//cloudresourcemanager.googleapis.com/projects/9876'--location=eu

Finding resource - The finding to be used for the SCC (Security Command Center)command. The arguments in this group can be used to specify the attributes ofthis resource.

This must be specified.

FINDING

ID of the finding or fully qualified identifier for the finding.

To set thefinding attribute:

• provide the argumentfinding on the command line.

This positional argument must be specified if any of the other arguments in thisgroup are specified.

--organization=ORGANIZATION

(Optional) If the full resource name isn't provided e.g. organizations/123, thenprovide the organization id which is the suffix of the organization. Example:organizations/123, the id is 123.

To set theorganization attribute:

• provide the argumentfinding on the command line with a fullyspecified name;
• provide the argument--organization on the command line;
• Set the organization property in configuration usinggcloud config setscc/organization if it is not specified in command line..

--source=SOURCE

(Optional) If the full resource name isn't provided e.g.organizations/123/sources/456, then provide the source id which is the suffix ofthe source. Example: organizations/123/sources/456, the id is 456.

To set thesource attribute:

• provide the argumentfinding on the command line with a fullyspecified name;
• provide the argument--source on the command line.

--category=CATEGORY

Taxonomy group within findings from a given source. Example: XSS_SCRIPTING

--event-time=EVENT_TIME

Time at which the event took place. For example, if the finding represents anopen firewall it would capture the time the open firewall was detected. Ifevent-time is not provided, it will default to UTC version of NOW. See$gcloud topicdatetimes for information on supported time formats.

--resource-name=RESOURCE_NAME

Full resource name of the Google Cloud Platform resource this finding is for.

--external-uri=EXTERNAL_URI

URI that, if available, points to a web page outside of Cloud SCC (SecurityCommand Center) where additional information about the finding can be found.This field is guaranteed to be either empty or a well formed URL.

--location=LOCATION; default="global"

When data residency controls are enabled, this attribute specifies the locationin which the resource is located and applicable. Thelocationattribute can be provided as part of the fully specified resource name or withthe--location argument on the command line. The default locationisglobal.

NOTE: If you override the endpoint to aregionalendpoint you must specify the correctdatalocation using this flag. The default location on this command is unrelatedto the default location that is specified when data residency controls areenabled for Security Command Center.

NOTE: If no location is specified, the default location isglobalAND the request will be routed to the SCC V1 API. To use the SCC V2 API - pleaseexplicitly specify the flag.

--source-properties=[KEY=VALUE,…]

Source specific properties. These properties are managed by the source thatwrites the finding. The key names in the source_properties map must be between 1and 255 characters, and must start with a letter and contain alphanumericcharacters or underscores only. For example "key1=val1,key2=val2"

--state=STATE

State is one of: [ACTIVE, INACTIVE].STATE must be oneof:active,inactive,state-unspecified.

Run$gcloud help for details.