gcloud scc assets group - filter an organization's assets and groups them by their specified properties

gcloud scc assets group[PARENT][--compare-duration=COMPARE_DURATION][--filter=FILTER][--group-by=GROUP_BY][--page-size=PAGE_SIZE][--page-token=PAGE_TOKEN][--read-time=READ_TIME][GCLOUD_WIDE_FLAG …]

gcloudsccassetsgroup123456--group-by="security_center_properties.resource_type"

Group assets under project example-project by their type (e.g. project, disk,compute instance, service etc):

gcloudsccassetsgroupprojects/example-project--group-by="security_center_properties.resource_type"

Group assets under folder 456 by their type (e.g. project, disk, computeinstance, service etc):

gcloudsccassetsgroupfolders/456--group-by="security_center_properties.resource_type"

Group compute instances (assets) under organization 123456 by their respectiveprojects:

gcloudsccassetsgroup123456--filter="security_center_properties.resource_type=\"google.compute.Instance\""--group-by="security_center_properties.resource_project"

Group assets that were updated on or after 2019-01-01T01:00:00 GMT by theirtypes.

gcloudsccassetsgroup123456--filter="update_time >= 1546304400000"--group-by="security_center_properties.resource_type"

Group assets into following 3 state_changes (ADDED/DELETED/ACTIVE) based on theactivity during past 24 hours:

gcloudsccassetsgroup123456--compare-duration=86400s--group-by="state_change"

Parent resource - parent organization, folder, or project in the Google Cloudresource hierarchy to be used for thegcloud scc command. Specify theargument as either [RESOURCE_TYPE/RESOURCE_ID] or [RESOURCE_ID], as shown in thepreceding examples. This represents a Cloud resource.

[PARENT]

ID of the parent or fully qualified identifier for the parent.

To set theparent attribute:

• provide the argumentparent on the command line;
• Set the parent property in configuration usinggcloud config setscc/parent if it is not specified in command line.

--compare-duration=COMPARE_DURATION

The result's "state_change" attribute is updated to indicate whether the assetwas added, removed, or remained present during the compare_duration period oftime that precedes the read_time. See$gcloud topic datetimesfor information on supported duration formats.

--filter=FILTER

Expression is a list of one or more restrictions combined via logical operators'AND' and 'OR'. Parentheses are not supported, and 'OR' has higher precedencethan 'AND'. For example, 'update_time > 100 ANDsecurity_center_properties.resource_type=\"google.cloud.resourcemanager.Organization\"'is a valid filter string.

--group-by=GROUP_BY

Expression that defines what asset fields to use for grouping (including'state'). String value should follow SQL syntax: comma separated list of fields.For example: "parent,resource_name". The following fields are supported:

• security_center_properties.resource_project
• security_center_properties.resource_type
• security_center_properties.resource_parent
• state_change

--page-size=PAGE_SIZE

The maximum number of results to return in a single response. Default is 10,minimum is 1, maximum is 1000.

--page-token=PAGE_TOKEN

Value returned by the last 'GroupAssetsResponse'; indicates that this is acontinuation of a prior 'GroupAssets' call, and that the system should returnthe next page of data.

--read-time=READ_TIME

Time used as a reference point when filtering. Absence of this field willdefault to the API's version of NOW. See$gcloud topic datetimesfor information on supported time formats.

Run$gcloud help for details.