Overview of custom modules for Security Health Analytics
This page provides an overview of Security Health Analyticscustom modules. Forinformation aboutbuilt-in modules, seeSecurity Health Analytics built-in detectors.
With custom modules, you can extend Security Health Analytics's detectioncapabilities by creating custom detectors that scan the Google Cloudresources and policies that you specify using rules that you define tocheck for vulnerabilities, misconfigurations, or compliance violations.
The configuration or definition of a custom module, whether you create it in theGoogle Cloud console or code it yourself, determines the resources thatthe detector checks, the properties the detector evaluates, and theinformation that the detector returns when a vulnerability ormisconfiguration is detected.
You can create custom modules for any resource or asset that Security Command Centersupports.
If you code custom module definitions yourself, you use YAMLand Common Expression Language (CEL) expressions. If you use theGoogle Cloud console to create your custom modules, most of the codingis done for you, although you do need to code the CEL expressions.
For an example of custom module definition in a YAML file, seeExample custom module definition.
Custom modules run alongside Security Health Analytics's built-in detectorsin both real-time and batch scans. In real-time mode, scansare triggered whenever an asset's configuration changes. Batch-modescans run with all detectors for enrolled organizations or projectsonce a day.
During a scan, each custom detector is applied to all matching assets in eachorganization, folder, or project for which it is enabled.
Findings from custom detectors are written to Security Command Center.
For more information, see the following:
- Creating custom modules
- Security Health Analytics scan types
- Supported resource types
- YAML
- Introduction to CEL
Comparing built-in detectors and custom modules
You can detect things with custom modules that you cannot detect with thebuilt-in Security Health Analytics detectors; however, built-in detectors supportcertain Security Command Center features that custom modules do not.
Feature support
Security Health Analytics custom modules are not supported by attack pathsimulations, so findings that are produced by custom modules do not getattack exposure scores or attack paths.
Comparing detection logic
As an example of some of the things that you can do with acustom module, compare what the built-in detectorPUBLIC_SQL_INSTANCEchecks for with what you can do with a custom module.
The built-in detectorPUBLIC_SQL_INSTANCE checks whether theauthorizedNetworks property of Cloud SQL instances is set to0.0.0.0/0.If it is, the detector generates a finding that states that the Cloud SQLinstance is open to the public, because it accepts connections from all IPaddresses.
With a custom module, you can implement more complex detectionlogic to check Cloud SQL instances for things like:
- IP addresses with specific prefixes, by using wildcards.
- The value of the
stateproperty, which you can use to ignore instancesif the value is set toMAINTENANCEor trigger findings if the value issomething else. - The value of the
regionproperty, which you can use to trigger findingsonly for instances with public IP addresses in specific regions.
Required IAM roles and permissions
IAM roles determine the actions that you can performwith Security Health Analytics custom modules.
The following table contains a list of Security Health Analytics custommodule permissions that are required as well as the predefined IAMroles that include them.
You can use the Google Cloud console or Security Command Center API to applythese roles at the organization, folder, or project level.
| Permissions required | Roles |
|---|---|
securitycentermanagement.securityHealthAnalyticsCustomModules.create | roles/securitycentermanagement.shaCustomModulesEditor |
securitycentermanagement.securityHealthAnalyticsCustomModules.list | roles/securitycentermanagement.shaCustomModulesViewer |
For more information about IAM permissions and roles and how to grant them, seeGrant an IAM role by using the Google Cloud console.
Custom module quotas
Security Health Analytics custom modules are subject to quota limits.
The default quota limit for the creation of custom modules is 100, but youcan request a quota increase, if necessary.
API calls to custom module methods are also subject to quota limits. Thefollowing table shows the default quota limits for custom module API calls.
| API Call Type | Limit |
|---|---|
| CustomModules Read Requests (Get, List) | 1,000 API calls per minute, per organization |
| CustomModules Write Requests (Create, Update, Delete) | 60 API calls per minute, per organization |
| CustomModules Test Requests | 12 API calls per minute, per organization |
For quota increases, submit a request in the Google Cloud console on theQuotas page.
For more information about Security Command Center quotas, seeQuotas and limits.
Supported resource types
Access Context Manageraccesscontextmanager.googleapis.com/AccessLevelaccesscontextmanager.googleapis.com/AccessPolicyaccesscontextmanager.googleapis.com/ServicePerimeterAddresscompute.googleapis.com/AddressAlert Policymonitoring.googleapis.com/AlertPolicyAlloyDB for PostgreSQLalloydb.googleapis.com/Backupalloydb.googleapis.com/Clusteralloydb.googleapis.com/InstanceApi Keysapikeys.googleapis.com/KeyArtifact Registry Repositoryartifactregistry.googleapis.com/RepositoryAutoscalercompute.googleapis.com/AutoscalerBackend Bucketcompute.googleapis.com/BackendBucketBackend Servicecompute.googleapis.com/BackendServiceBigQuery Data Transfer Servicebigquerydatatransfer.googleapis.com/TransferConfigBigQuery Modelbigquery.googleapis.com/ModelBigQuery Tablebigquery.googleapis.com/TableBucketstorage.googleapis.com/BucketCloud Billing Project Billing Infocloudbilling.googleapis.com/ProjectBillingInfoCloud Data Fusiondatafusion.googleapis.com/InstanceCloud Functioncloudfunctions.googleapis.com/CloudFunctionCloud Runrun.googleapis.com/DomainMappingrun.googleapis.com/Executionrun.googleapis.com/Jobrun.googleapis.com/Revisionrun.googleapis.com/ServiceClustercontainer.googleapis.com/ClusterCluster Rolerbac.authorization.k8s.io/ClusterRoleCluster Role Bindingrbac.authorization.k8s.io/ClusterRoleBindingCommitmentcompute.googleapis.com/CommitmentComposer Environmentcomposer.googleapis.com/EnvironmentCompute Projectcompute.googleapis.com/Projectcompute.googleapis.com/SecurityPolicyCryptoKeycloudkms.googleapis.com/CryptoKeyCryptoKey Versioncloudkms.googleapis.com/CryptoKeyVersionDataflow Jobdataflow.googleapis.com/JobDataproc Autoscaling Policydataproc.googleapis.com/AutoscalingPolicyDataproc Batchdataproc.googleapis.com/BatchDataproc Clusterdataproc.googleapis.com/ClusterDataproc Jobdataproc.googleapis.com/JobDatasetbigquery.googleapis.com/DatasetDatastream Connection Profiledatastream.googleapis.com/ConnectionProfileDatastream Private Connectiondatastream.googleapis.com/PrivateConnectionDatastream Streamdatastream.googleapis.com/StreamDialogflow CXdialogflow.googleapis.com/AgentDiskcompute.googleapis.com/DiskDLP Deidentify Templatedlp.googleapis.com/DeidentifyTemplateDLP Inspect Templatedlp.googleapis.com/InspectTemplateDLP Jobdlp.googleapis.com/DlpJobDLP Job Triggerdlp.googleapis.com/JobTriggerDLP Stored Info Typedlp.googleapis.com/StoredInfoTypeDNS Policydns.googleapis.com/PolicyFile Instancefile.googleapis.com/InstanceFirewallcompute.googleapis.com/FirewallFirewall Policycompute.googleapis.com/FirewallPolicyFoldercloudresourcemanager.googleapis.com/FolderForwarding Rulecompute.googleapis.com/ForwardingRuleGlobal Forwarding Rulecompute.googleapis.com/GlobalForwardingRuleHealth Checkcompute.googleapis.com/HealthCheckHubgkehub.googleapis.com/Featuregkehub.googleapis.com/MembershipIAM Roleiam.googleapis.com/RoleImagecompute.googleapis.com/ImageInstancecompute.googleapis.com/InstanceInstance Groupcompute.googleapis.com/InstanceGroupInstance Group Managercompute.googleapis.com/InstanceGroupManagersInstance Templatecompute.googleapis.com/InstanceTemplateInterconnect Attachmentcompute.googleapis.com/InterconnectAttachmentKeyringcloudkms.googleapis.com/KeyRingKMS Import Jobcloudkms.googleapis.com/ImportJobKubernetes CronJobbatch.k8s.io/CronJobKubernetes DaemonSetapps.k8s.io/DaemonSetKubernetes Deploymentapps.k8s.io/DeploymentKubernetes Ingressnetworking.k8s.io/IngressKubernetes NetworkPolicynetworking.k8s.io/NetworkPolicyKubernetes ReplicaSetapps.k8s.io/ReplicaSetKubernetes Servicek8s.io/ServiceKubernetes StatefulSetapps.k8s.io/StatefulSetLog Bucketlogging.googleapis.com/LogBucketLog Metriclogging.googleapis.com/LogMetricLog Sinklogging.googleapis.com/LogSinkManaged Zonedns.googleapis.com/ManagedZoneMachine Imagecompute.googleapis.com/MachineImageMonitoring Notification Channelmonitoring.googleapis.com/NotificationChannelNamespacek8s.io/NamespaceNetApp Snapshotnetapp.googleapis.com/SnapshotNetApp Volumenetapp.googleapis.com/VolumeNetworkcompute.googleapis.com/NetworkNetwork Endpoint Groupcompute.googleapis.com/NetworkEndpointGroupNodek8s.io/NodeNode Groupcompute.googleapis.com/NodeGroupNode Templatecompute.googleapis.com/NodeTemplateNodepoolcontainer.googleapis.com/NodePoolOrganizationcloudresourcemanager.googleapis.com/OrganizationOrganization Policy Service v2orgpolicy.googleapis.com/CustomConstraintorgpolicy.googleapis.com/PolicyPacket Mirroringcompute.googleapis.com/PacketMirroringPodk8s.io/PodPrivate CA Certificateprivateca.googleapis.com/CertificatePrivate CA Certificate Revocation Listprivateca.googleapis.com/CertificateRevocationListProjectcloudresourcemanager.googleapis.com/ProjectPubsub Snapshotpubsub.googleapis.com/SnapshotPubsub Subscriptionpubsub.googleapis.com/SubscriptionPubsub Topicpubsub.googleapis.com/TopicRedis Clusterredis.googleapis.com/ClusterRedis Instanceredis.googleapis.com/InstanceRegion Backend Servicecompute.googleapis.com/RegionBackendServiceRegion Diskcompute.googleapis.com/RegionDiskReservationcompute.googleapis.com/ReservationResource Policycompute.googleapis.com/ResourcePolicyRoutecompute.googleapis.com/RouteRoutercompute.googleapis.com/RouterRolerbac.authorization.k8s.io/RoleRole Bindingrbac.authorization.k8s.io/RoleBindingSecret Managersecretmanager.googleapis.com/SecretSecret Versionsecretmanager.googleapis.com/SecretVersionService Account Keyiam.googleapis.com/ServiceAccountKeyServiceUsage Serviceserviceusage.googleapis.com/ServiceSnapshotcompute.googleapis.com/SnapshotSpanner Backupspanner.googleapis.com/BackupSpanner Databasespanner.googleapis.com/DatabaseSpanner Instancespanner.googleapis.com/InstanceSQL Backup Runsqladmin.googleapis.com/BackupRunSQL Instancesqladmin.googleapis.com/InstanceSSL Certificatecompute.googleapis.com/SslCertificateSSL Policycompute.googleapis.com/SslPolicySubnetworkcompute.googleapis.com/SubnetworkTag Bindingcloudresourcemanager.googleapis.com/TagBindingTarget HTTP Proxycompute.googleapis.com/TargetHttpProxyTarget HTTPS Proxycompute.googleapis.com/TargetHttpsProxyTarget Instancecompute.googleapis.com/TargetInstanceTarget Poolcompute.googleapis.com/TargetPoolTarget SSL Proxycompute.googleapis.com/TargetSslProxyTarget VPN Gatewaycompute.googleapis.com/TargetVpnGatewayURL Mapcompute.googleapis.com/UrlMapVertex AIaiplatform.googleapis.com/BatchPredictionJobaiplatform.googleapis.com/CustomJobaiplatform.googleapis.com/Datasetaiplatform.googleapis.com/Endpointaiplatform.googleapis.com/Featurestoreaiplatform.googleapis.com/HyperparameterTuningJobaiplatform.googleapis.com/Indexaiplatform.googleapis.com/MetadataStoreaiplatform.googleapis.com/Modelaiplatform.googleapis.com/SpecialistPoolaiplatform.googleapis.com/Tensorboardaiplatform.googleapis.com/TrainingPipelineaiplatform.googleapis.com/NotebookRuntimeTemplateVertex AI Workbenchnotebooks.googleapis.com/InstanceVMware Enginevmwareengine.googleapis.com/Clustervmwareengine.googleapis.com/ExternalAccessRulevmwareengine.googleapis.com/ExternalAddressvmwareengine.googleapis.com/VmwareEngineNetworkvmwareengine.googleapis.com/NetworkPeeringvmwareengine.googleapis.com/NetworkPolicyvmwareengine.googleapis.com/PrivateCloudvmwareengine.googleapis.com/PrivateConnectionVPC Connectorvpcaccess.googleapis.com/ConnectorVPN Gatewaycompute.googleapis.com/VpnGatewayVPN Tunnelcompute.googleapis.com/VpnTunnelWorkstationsworkstations.googleapis.com/Workstationworkstations.googleapis.com/WorkstationConfig
What's next
- To work with custom modules, seeUsing custom modules for Security Health Analytics.
- To code custom module definitions yourself, seeCode custom modules for Security Health Analytics.
- To test your custom modules, seeTest custom modules for Security Health Analytics.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-20 UTC.