gcloud scc findings list - list an organization or source's findings

gcloud scc findings list[PARENT][--compare-duration=COMPARE_DURATION][--field-mask=FIELD_MASK][--location=LOCATION; default="global"][--order-by=ORDER_BY][--page-token=PAGE_TOKEN][--read-time=READ_TIME][--source=SOURCE; default="-"][--folder=FOLDER    |--organization=ORGANIZATION    |--project=PROJECT][--filter=EXPRESSION][--limit=LIMIT][--page-size=PAGE_SIZE][--sort-by=[FIELD,…]][GCLOUD_WIDE_FLAG …]

gcloudsccfindingslist123456--filter="state=\"ACTIVE\""

List all ACTIVE findings under projectabc across all sources:

gcloudsccfindingslistprojects/abc--filter="state=\"ACTIVE\""

List all ACTIVE findings under folder456 across all sources:

gcloudsccfindingslistfolders/456--filter="state=\"ACTIVE\""

List all ACTIVE findings under organization123456 and source5678:

gcloudsccfindingslist123456--source=5678--filter="state=\"ACTIVE\""

Only list category and resource_name of all ACTIVE findings under organization123456 and source5678:

gcloudsccfindingslist123456--source=5678--filter="state=\"ACTIVE\""--field-mask="finding.category,finding.resource_name"

List all ACTIVE findings of XSS category/type, under organization123456 and source5678:

gcloudsccfindingslist123456--source=5678--filter="state=\"ACTIVE\" AND category=\"XSS\""

List all findings attached to a particular resource under organization123456:

gcloudsccfindingslist123456--filter="resource_name=\"//container.googleapis.com/projects/pid/zones/zone-id/clusters/cluster-id\""

List all ACTIVE findings that took place on2019-01-01T01:00:00 GMTtime, under organization123456:

gcloudsccfindingslist123456--filter="state=\"ACTIVE\" AND event_time > 1546304400000""

List all findings under organization123456 across all sources andlocation=eu:

gcloudsccfindingslist123456--location=eu

Parent resource - parent organization, folder, or project in the Google Cloudresource hierarchy to be used for thegcloud scc command. Specify theargument as either [RESOURCE_TYPE/RESOURCE_ID] or [RESOURCE_ID], as shown in thepreceding examples. This represents a Cloud resource.

[PARENT]

ID of the parent or fully qualified identifier for the parent.

To set theparent attribute:

• provide the argumentparent on the command line;
• Set the parent property in configuration usinggcloud config setscc/parent if it is not specified in command line.

--compare-duration=COMPARE_DURATION

(DEPRECATED) When compare_duration is set, the result's "state_change" attributeis updated to indicate whether the finding had its state changed, the finding'sstate remained unchanged, or if the finding was added during thecompare_duration period of time that precedes the read_time. This is the timebetween (read_time - compare_duration) and read_time. The state_change value isderived based on the presence and state of the finding at the two points intime. Intermediate state changes between the two times don't affect the result.For example, the results aren't affected if the finding is made inactive andthen active again. Possible "state_change" values when compare_duration isspecified:

• 'CHANGED': indicates that the finding was present at the start ofcompare_duration, but changed its state at read_time.

• 'UNCHANGED': indicates that the finding was present at the start ofcompare_duration and did not change state at read_time.

• 'ADDED': indicates that the finding was not present at the start ofcompare_duration, but was present at read_time.

• 'REMOVED': indicates that the finding was present at the start ofcompare_duration, but was not present at read_time.

Ifcompare_durationisnotspecified,thentheonlypossiblestate_changeis'UNUSED',whichwillbethestate_changesetforallfindingspresentatread_time.Ifthisfieldissetthen'state_change'mustbeaspecifiedfieldin'group_by'.See$gcloudtopicdatetimesforinformationonsupporteddurationformats.

The --compare-duration option is deprecated. For more information,seethe deprecation notice on the SCC release notes page.

--field-mask=FIELD_MASK

Field mask to specify the finding fields listed in the response. An empty fieldmask will list all fields. For example:--field-mask="finding.category,finding.resource_name" will only output categoryand resource_name for the findings in addition to default attributes. Notice thedifference between hyphens (-) used with flags v/s camel case used in fieldmasks. An empty or missing field mask will list all fields.

--location=LOCATION; default="global"

When data residency controls are enabled, this attribute specifies the locationin which the resource is located and applicable. Thelocationattribute can be provided as part of the fully specified resource name or withthe--location argument on the command line. The default locationisglobal.

NOTE: If you override the endpoint to aregionalendpoint you must specify the correctdatalocation using this flag. The default location on this command is unrelatedto the default location that is specified when data residency controls areenabled for Security Command Center.

NOTE: If no location is specified, the default location isglobalAND the request will be routed to the SCC V1 API. To use the SCC V2 API - pleaseexplicitly specify the flag.

--order-by=ORDER_BY

Expression that defines what fields and order to use for sorting. String valueshould follow SQL syntax: comma separated list of fields. For example:"name,resource_properties.a_property". The default sorting order is ascending.To specify descending order for a field, a suffix " desc" should be appended tothe field name. For example: --order-by="name desc,source_properties.a_property"will order by name in descending order while source_properties.a_property inascending order.

--page-token=PAGE_TOKEN

Response objects will return a non-null value for page-token to indicate thatthere is at least one additional page of data. User can either directly requestthat page by specifying the page-token explicitly or let gcloud fetchone-page-at-a-time.

--read-time=READ_TIME

(DEPRECATED) Time used as a reference point when filtering. Absence of thisfield will default to the API's version of NOW. See $gcloud topic datetimes forinformation on supported time formats.

The --read-time option is deprecated. For more information,seethe deprecation notice on the SCC release notes page.

--source=SOURCE; default="-"

Source id. Defaults to all sources.

At most one of these can be specified:

--folder=FOLDER

The folder ID (e.g., 456) that contains the finding.

--organization=ORGANIZATION

The organization ID (e.g., 123) that contains the finding.

--project=PROJECT

The project ID (e.g., example-project) that contains the finding.

--filter=EXPRESSION

Apply a Boolean filterEXPRESSION to each resource itemto be listed. If the expression evaluatesTrue, then that item islisted. For more details and examples of filter expressions, run $gcloud topic filters. This flaginteracts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

--limit=LIMIT

Maximum number of resources to list. The default isunlimited. Thisflag interacts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

--page-size=PAGE_SIZE

Some services group resource list output into pages. This flag specifies themaximum number of resources per page. The default is determined by the serviceif it supports paging, otherwise it isunlimited (no paging).Paging may be applied before or after--filter and--limit depending on the service.

--sort-by=[FIELD,…]

Comma-separated list of resource field key names to sort by. The default orderis ascending. Prefix a field with ``~´´ for descending order on thatfield. This flag interacts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

Run$gcloud help for details.