gcloud scc findings group - filter an organization or source's findings and groups them by their specified properties

gcloud scc findings group[PARENT][--compare-duration=COMPARE_DURATION][--filter=FILTER][--group-by=GROUP_BY][--location=LOCATION; default="global"][--page-size=PAGE_SIZE][--page-token=PAGE_TOKEN][--read-time=READ_TIME][--source=SOURCE; default="-"][GCLOUD_WIDE_FLAG …]

gcloudsccfindingsgroup123456--group-by="category"

Group findings under projectexample-project across all sources bytheir category:

gcloudsccfindingsgroupprojects/example-project--group-by="category"

Group findings under folders456 across all sources by theircategory:

gcloudsccfindingsgroupfolders/456--group-by="category"

Group findings under organization123456 and source5678, by their category:

gcloudsccfindingsgroup123456--source=5678--group-by="category"

Group ACTIVE findings under organization123456 and source5678, by their category:

gcloudsccfindingsgroup123456--source=5678--group-by="category"--filter="state=\"ACTIVE\""

Group findings under organization123456 andlocation=eu across all sources by their category:

gcloudsccfindingsgroup123456--group-by="category"--location=eu

Parent resource - parent organization, folder, or project in the Google Cloudresource hierarchy to be used for thegcloud scc command. Specify theargument as either [RESOURCE_TYPE/RESOURCE_ID] or [RESOURCE_ID], as shown in thepreceding examples. This represents a Cloud resource.

[PARENT]

ID of the parent or fully qualified identifier for the parent.

To set theparent attribute:

• provide the argumentparent on the command line;
• Set the parent property in configuration usinggcloud config setscc/parent if it is not specified in command line.

--compare-duration=COMPARE_DURATION

(DEPRECATED) When compare_duration is set, the result's "state_change" attributeis updated to indicate whether the finding had its state changed, the finding'sstate remained unchanged, or if the finding was added during thecompare_duration period of time that precedes the read_time. This is the timebetween (read_time - compare_duration) and read_time. The state_change value isderived based on the presence and state of the finding at the two points intime. Intermediate state changes between the two times don't affect the result.For example, the results aren't affected if the finding is made inactive andthen active again. Possible "state_change" values when compare_duration isspecified:

• 'CHANGED': indicates that the finding was present at the start ofcompare_duration, but changed its state at read_time.

• 'UNCHANGED': indicates that the finding was present at the start ofcompare_duration and did not change state at read_time.

• 'ADDED': indicates that the finding was not present at the start ofcompare_duration, but was present at read_time.

• 'REMOVED': indicates that the finding was present at the start ofcompare_duration, but was not present at read_time.

Ifcompare_durationisnotspecified,thentheonlypossiblestate_changeis'UNUSED',whichwillbethestate_changesetforallfindingspresentatread_time.Ifthisfieldissetthen'state_change'mustbeaspecifiedfieldin'group_by'.See$gcloudtopicdatetimesforinformationonsupporteddurationformats.

The --compare-duration option is deprecated. For more information,seethe deprecation notice on the SCC release notes page.

--filter=FILTER

Expression that defines the filter to apply across findings. The expression is alist of one or more restrictions combined via logical operators 'AND' and 'OR'.Parentheses are supported, and 'OR' has higher precedence than 'AND'.Restrictions have the form '<field> <operator> <value>' andmay have a '-' character in front of them to indicate negation. Examplesinclude: name, source_properties.a_property, security_marks.marks.marka. Thesupported operators are:

• '=' for all value types.
• '>', '<', '>=', '<=' for integer values.
• ':', meaning substring matching, for strings.

The supported value types are:string literals in quotes, integer literalswithout quotes, boolean literals 'true' and 'false' without quotes. Some examplefilters: 'source_properties.size = 100', 'category=\"XSS\" AND event_time >10' etc.

--group-by=GROUP_BY

Expression that defines what findings fields to use for grouping (including'state'). String value should follow SQL syntax: comma separated list of fields.For example: "parent,resource_name". The following fields are supported:

• resource_name
• category
• state
• parent

--location=LOCATION; default="global"

When data residency controls are enabled, this attribute specifies the locationin which the resource is located and applicable. Thelocationattribute can be provided as part of the fully specified resource name or withthe--location argument on the command line. The default locationisglobal.

NOTE: If you override the endpoint to aregionalendpoint you must specify the correctdatalocation using this flag. The default location on this command is unrelatedto the default location that is specified when data residency controls areenabled for Security Command Center.

NOTE: If no location is specified, the default location isglobalAND the request will be routed to the SCC V1 API. To use the SCC V2 API - pleaseexplicitly specify the flag.

--page-size=PAGE_SIZE

Maximum number of results to return in a single response. Default is 10, minimumis 1, maximum is 1000.

--page-token=PAGE_TOKEN

Response objects will return a non-null value for page-token to indicate thatthere is at least one additional page of data. User can either directly requestthat page by specifying the page-token explicitly or let gcloud fetchone-page-at-a-time.

--read-time=READ_TIME

(DEPRECATED) Time used as a reference point when filtering. Absence of thisfield will default to the API's version of NOW. See $gcloud topic datetimes forinformation on supported time formats.

The --read-time option is deprecated. For more information,seethe deprecation notice on the SCC release notes page.

--source=SOURCE; default="-"

Source id. Defaults to all sources.

Run$gcloud help for details.