Skip to main content

​
List findings

Action ID: tools.google_scc.list_findings List Security Command Center findings under an organization, folder, or project scope. Returns findings, total_size, and a truncated flag. Pages are held in memory, so max_pages is bounded by default. Reference: https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/list

​
Secrets

Optional secrets:
  • google_oauth: OAuth token GOOGLE_SERVICE_TOKEN.
  • google_api: required values GOOGLE_API_CREDENTIALS.

​
Input fields

​
string
required
Parent scope. One of organizations/{id}, folders/{id}, or projects/{id}.
​
string | null
SCC filter expression, e.g. state="ACTIVE" AND severity="HIGH".Default: null.
​
integer | null
Maximum pages to fetch. Null fetches every page. If the cap truncates the result, truncated is true and next_page_token is returned.Default: 10.
​
string | null
Comma-separated fields to sort by, e.g. event_time desc.Default: null.
​
integer
Number of findings per page (max 1000).Default: 100.
​
string
Source ID to list findings from. Use - for all sources.Default: "-".

​
List sources

Action ID: tools.google_scc.list_sources List Security Command Center finding sources under an organization, folder, or project scope. Returns a flat list of sources. Reference: https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources/list

​
Secrets

Optional secrets:
  • google_oauth: OAuth token GOOGLE_SERVICE_TOKEN.
  • google_api: required values GOOGLE_API_CREDENTIALS.

​
Input fields

​
string
required
Parent scope. One of organizations/{id}, folders/{id}, or projects/{id}.
​
integer | null
Maximum number of pages to fetch. If null, fetches every page.Default: null.
​
integer
Number of sources per page.Default: 100.

​
Mute finding

Action ID: tools.google_scc.mute_finding Set the mute status of a Security Command Center finding. Reference: https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setMute

​
Secrets

Optional secrets:
  • google_oauth: OAuth token GOOGLE_SERVICE_TOKEN.
  • google_api: required values GOOGLE_API_CREDENTIALS.

​
Input fields

​
string
required
Full finding resource name, e.g. organizations/{org}/sources/{src}/locations/{loc}/findings/{id}. The scope prefix decides which IAM permissions are checked, so pass canonicalName from list_findings if you hold project-level access; name is always organization-scoped.
​
string
required
New mute state: MUTED, UNMUTED, or UNDEFINED (no explicit decision).

​
Set finding state

Action ID: tools.google_scc.set_finding_state Update the state of a Security Command Center finding. Reference: https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setState

​
Secrets

Optional secrets:
  • google_oauth: OAuth token GOOGLE_SERVICE_TOKEN.
  • google_api: required values GOOGLE_API_CREDENTIALS.

​
Input fields

​
string
required
Full finding resource name, e.g. organizations/{org}/sources/{src}/locations/{loc}/findings/{id}. The scope prefix decides which IAM permissions are checked, so pass canonicalName from list_findings if you hold project-level access; name is always organization-scoped.
​
string
required
New finding state: ACTIVE or INACTIVE. To silence an accepted risk rather than mark it fixed, use mute_finding.