Google Cloudintermediate

GCP Security Command Center Vulnerability Scanning Guide

Learn to implement continuous vulnerability assessment with GCP Security Command Center. Covers Security Health Analytics, Web Security Scanner, and Container Threat Detection.

11 min readUpdated 2026-01-14

Security Command Center (SCC) is Google Cloud's native security and risk management platform. It provides continuous vulnerability assessment, threat detection, and compliance monitoring across your entire GCP environment. Understanding how to leverage its vulnerability scanning capabilities is essential for maintaining a strong security posture.

This guide covers configuring Security Health Analytics, Web Security Scanner, and Container Threat Detection for comprehensive vulnerability management. For foundational security practices, see our 30 Cloud Security Tips for 2026 guide.

Prerequisites

  • Security Center Admin role for SCC configuration
  • Organization-level access for full functionality
  • SCC Premium tier for advanced features (recommended)
  • gcloud CLI installed and configured

Enable Security Command Center API

# Enable the SCC API
gcloud services enable securitycenter.googleapis.com

# Enable Container Analysis for vulnerability scanning
gcloud services enable containeranalysis.googleapis.com

# Enable Web Security Scanner
gcloud services enable websecurityscanner.googleapis.com

Step 1: Configure Security Health Analytics

Security Health Analytics is the core vulnerability detection service in SCC:

Enable at Organization Level

    - Navigate to [Security Command Center](https://console.cloud.google.com/security/command-center) - Select your organization at the top - Go to **Settings > Security Health Analytics** - Click **Enable** if not already enabled - Select the service tier (Standard or Premium)

Via gcloud CLI

# Enable Security Health Analytics for the organization
gcloud scc settings services enable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS

# Check service status
gcloud scc settings services describe \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS

Customize Detection Modules

Enable or disable specific vulnerability detectors:

# List available modules
gcloud scc settings services modules list \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS

# Enable a specific module
gcloud scc settings services modules enable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=PUBLIC_SQL_INSTANCE

# Disable a module (use carefully)
gcloud scc settings services modules disable \
    --organization=ORGANIZATION_ID \
    --service=SECURITY_HEALTH_ANALYTICS \
    --module=OPEN_CISCOSECURE_WEBSM_PORT

Step 2: View and Manage Vulnerability Findings

Via Console

    - Go to **Security Command Center > Findings** - Filter by:

    • Source: Security Health Analytics

    • State: Active

    • Severity: Critical, High, Medium, Low

    • Click on a finding for details and remediation guidance

Via gcloud CLI

# List all active vulnerability findings
gcloud scc findings list ORGANIZATION_ID \
    --source="-" \
    --filter="state=\"ACTIVE\" AND category=\"VULNERABILITY\"" \
    --format="table(finding.category,finding.severity,finding.resourceName)"

# List critical and high severity findings
gcloud scc findings list ORGANIZATION_ID \
    --source="-" \
    --filter="state=\"ACTIVE\" AND (severity=\"CRITICAL\" OR severity=\"HIGH\")" \
    --format="table(finding.category,finding.severity,finding.resourceName,finding.createTime)"

# List findings for a specific project
gcloud scc findings list ORGANIZATION_ID \
    --source="-" \
    --filter="resource.projectDisplayName=\"my-project\" AND state=\"ACTIVE\"" \
    --limit=50

Common Security Health Analytics Findings

Finding CategorySeverityDescription
PUBLIC_SQL_INSTANCECriticalCloud SQL instance exposed to internet
OPEN_FIREWALLHighFirewall allows traffic from 0.0.0.0/0
MFA_NOT_ENFORCEDHighMFA not required for user accounts
BUCKET_POLICY_ONLY_DISABLEDMediumBucket has ACLs instead of IAM only
COMPUTE_SECURE_BOOT_DISABLEDMediumShielded VM secure boot not enabled

Step 3: Configure Web Security Scanner

Web Security Scanner identifies vulnerabilities in web applications:

Create a Managed Scan

    - Go to **Security Command Center > Web Security Scanner** - Click **New Scan** - Configure:

    • Starting URLs: https://your-app.example.com

    • Excluded URLs: Paths to skip (admin, logout)

    • Authentication: Google account or custom

    • Schedule: Daily, weekly, or manual

    • Click Create

Via gcloud CLI

# Create a scan configuration
gcloud web-security-scanner scan-configs create \
    --display-name="Production App Scan" \
    --starting-urls="https://app.example.com" \
    --excluded-urls="https://app.example.com/logout,https://app.example.com/admin/*" \
    --max-qps=15 \
    --project=PROJECT_ID

# List scan configurations
gcloud web-security-scanner scan-configs list --project=PROJECT_ID

# Start a scan
gcloud web-security-scanner scan-runs start SCAN_CONFIG_ID --project=PROJECT_ID

# Get scan results
gcloud web-security-scanner scan-runs describe SCAN_RUN_ID \
    --scan-config=SCAN_CONFIG_ID \
    --project=PROJECT_ID

Vulnerability Types Detected

  • XSS (Cross-Site Scripting) - Reflected and stored XSS vulnerabilities
  • SQL Injection - Database injection flaws
  • Mixed Content - HTTPS pages loading HTTP resources
  • Outdated Libraries - Known vulnerable JavaScript libraries
  • Clear Text Passwords - Passwords transmitted without encryption
  • Insecure Headers - Missing security headers (CSP, HSTS)

Step 4: Enable Container Threat Detection

Container Threat Detection monitors GKE clusters for runtime threats (Premium tier required):

Enable for GKE Clusters

# Enable Container Threat Detection service
gcloud scc settings services enable \
    --organization=ORGANIZATION_ID \
    --service=CONTAINER_THREAT_DETECTION

# Verify it's enabled
gcloud scc settings services describe \
    --organization=ORGANIZATION_ID \
    --service=CONTAINER_THREAT_DETECTION

Enable on Existing GKE Cluster

# Enable Security Posture on cluster
gcloud container clusters update CLUSTER_NAME \
    --zone=ZONE \
    --security-posture=standard

# Enable workload vulnerability scanning
gcloud container clusters update CLUSTER_NAME \
    --zone=ZONE \
    --workload-vulnerability-scanning=standard

Container Threats Detected

  • Malicious Script Execution - Suspicious scripts running in containers
  • Reverse Shell - Outbound shell connections
  • Added Binary Executed - New binaries dropped and executed
  • Crypto Mining - Cryptocurrency mining activity
  • Privilege Escalation - Container escape attempts

Step 5: Configure Artifact Registry Vulnerability Scanning

Scan container images for CVEs before deployment:

Enable Vulnerability Scanning

# Enable Container Analysis API
gcloud services enable containeranalysis.googleapis.com
gcloud services enable containerscanning.googleapis.com

# Scanning is automatic for images in Artifact Registry
# Push an image to trigger scanning
docker push us-central1-docker.pkg.dev/PROJECT_ID/REPO/IMAGE:TAG

View Image Vulnerabilities

# List vulnerabilities for an image
gcloud artifacts docker images list-vulnerabilities \
    us-central1-docker.pkg.dev/PROJECT_ID/REPO/IMAGE \
    --format="table(vulnerability.shortDescription,vulnerability.severity,vulnerability.packageIssue.affectedPackage)"

# Get scan results via API
gcloud artifacts docker images describe \
    us-central1-docker.pkg.dev/PROJECT_ID/REPO/IMAGE:TAG \
    --show-package-vulnerability

Block Vulnerable Images with Binary Authorization

# Enable Binary Authorization API
gcloud services enable binaryauthorization.googleapis.com

# Create attestor for vulnerability checks
gcloud container binauthz attestors create vulnerability-attestor \
    --attestation-authority-note=vulnerability-note \
    --attestation-authority-note-project=PROJECT_ID

Step 6: Create Custom Findings and Notifications

Create Pub/Sub Notifications

# Create Pub/Sub topic for findings
gcloud pubsub topics create scc-findings

# Create notification config
gcloud scc notifications create security-alerts \
    --organization=ORGANIZATION_ID \
    --pubsub-topic=projects/PROJECT_ID/topics/scc-findings \
    --filter="state=\"ACTIVE\" AND severity=\"CRITICAL\""

Export Findings to SIEM

    - Go to **Security Command Center > Settings > Continuous exports** - Click **Create export** - Configure:

    • Export name: siem-export

    • Destination: BigQuery or Pub/Sub

    • Filter: Select findings to export

    • Click Create

Step 7: Automate Remediation

Create automated responses to vulnerability findings:

# Example Cloud Function to remediate public buckets
import functions_framework
from google.cloud import storage

@functions_framework.http
def remediate_public_bucket(request):
    data = request.get_json()
    bucket_name = data['finding']['resource']['name'].split('/')[-1]

    client = storage.Client()
    bucket = client.bucket(bucket_name)

    # Remove public access
    bucket.iam_configuration.public_access_prevention = 'enforced'
    bucket.patch()

    return f'Remediated public access for bucket: {bucket_name}'

Best Practices for Vulnerability Scanning

  • Enable Premium tier - Required for comprehensive threat detection and compliance
  • Configure all detection modules - Enable relevant detectors for your environment
  • Set up notifications - Alert on critical and high severity findings immediately
  • Integrate with ticketing - Export to Jira/ServiceNow for tracking remediation
  • Scan containers before deployment - Block images with critical CVEs
  • Schedule regular web scans - Weekly scans for production applications
  • Review findings daily - Triage new vulnerabilities promptly
  • Document exceptions - Track accepted risks with justification

Need help implementing comprehensive vulnerability management? Contact InventiveHQ for expert guidance on cloud security and threat detection.

Frequently Asked Questions

Find answers to common questions

SCC Standard tier (free) includes Security Health Analytics with basic vulnerability findings, asset inventory, and IAM recommendations. SCC Premium tier adds Container Threat Detection, Virtual Machine Threat Detection, Event Threat Detection, Web Security Scanner managed scans, compliance reporting (CIS, PCI DSS, NIST), and attack path simulation. Premium is required for comprehensive vulnerability management.

Expert GCP Management

From architecture design to managed operations, we handle your Google Cloud infrastructure.

Learn About Cloud Infrastructure ManagementExplore Cloud Optimization

Related Articles

How to Enable Cloud Audit Logs in GCP

Complete guide to enabling and configuring Google Cloud Audit Logs. Learn to set up Admin Activity logs, Data Access logs, log sinks, exports to BigQuery, and retention policies for compliance and security monitoring.

Read More →

GCP Cloud Armor Setup Guide: WAF, Rate Limiting, and DDoS Protection

Complete guide to setting up Google Cloud Armor for web application security. Covers WAF policies, OWASP Top 10 protection, rate limiting, adaptive protection, and DDoS mitigation for applications behind load balancers.

Read More →

GCP Data Loss Prevention (DLP) API Guide

Discover and protect sensitive data with Google Cloud DLP API. Learn to configure InfoTypes, run inspection jobs, implement de-identification, and integrate with BigQuery.

Read More →
Back to Google Cloud