> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Security Command Center

> Reference for the Tracecat Google Security Command Center integration: registered actions, required secrets, expected inputs, and example workflow usage.

## List findings

Action ID: `tools.google_scc.list_findings`

List Security Command Center findings under an organization, folder, or project scope. Returns `findings`, `total_size`, and a `truncated` flag. Pages are held in memory, so `max_pages` is bounded by default.

Reference: [https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/list](https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/list)

### Secrets

Optional secrets:

* `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`.

### Input fields

<ParamField path="scope" type="string" required>
  Parent scope. One of `organizations/&#123;id&#125;`, `folders/&#123;id&#125;`, or `projects/&#123;id&#125;`.
</ParamField>

<ParamField path="filter" type="string | null">
  SCC filter expression, e.g. `state="ACTIVE" AND severity="HIGH"`.

  Default: `null`.
</ParamField>

<ParamField path="max_pages" type="integer | null">
  Maximum pages to fetch. Null fetches every page. If the cap truncates the result, `truncated` is true and `next_page_token` is returned.

  Default: `10`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Comma-separated fields to sort by, e.g. `event_time desc`.

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer">
  Number of findings per page (max 1000).

  Default: `100`.
</ParamField>

<ParamField path="source" type="string">
  Source ID to list findings from. Use `-` for all sources.

  Default: `"-"`.
</ParamField>

## List sources

Action ID: `tools.google_scc.list_sources`

List Security Command Center finding sources under an organization, folder, or project scope. Returns a flat list of sources.

Reference: [https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources/list](https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources/list)

### Secrets

Optional secrets:

* `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`.

### Input fields

<ParamField path="scope" type="string" required>
  Parent scope. One of `organizations/&#123;id&#125;`, `folders/&#123;id&#125;`, or `projects/&#123;id&#125;`.
</ParamField>

<ParamField path="max_pages" type="integer | null">
  Maximum number of pages to fetch. If null, fetches every page.

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer">
  Number of sources per page.

  Default: `100`.
</ParamField>

## Mute finding

Action ID: `tools.google_scc.mute_finding`

Set the mute status of a Security Command Center finding.

Reference: [https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setMute](https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setMute)

### Secrets

Optional secrets:

* `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`.

### Input fields

<ParamField path="finding_name" type="string" required>
  Full finding resource name, e.g. `organizations/&#123;org&#125;/sources/&#123;src&#125;/locations/&#123;loc&#125;/findings/&#123;id&#125;`. The scope prefix decides which IAM permissions are checked, so pass `canonicalName` from `list_findings` if you hold project-level access; `name` is always organization-scoped.
</ParamField>

<ParamField path="mute" type="string" required>
  New mute state: `MUTED`, `UNMUTED`, or `UNDEFINED` (no explicit decision).
</ParamField>

## Set finding state

Action ID: `tools.google_scc.set_finding_state`

Update the state of a Security Command Center finding.

Reference: [https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setState](https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings/setState)

### Secrets

Optional secrets:

* `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`.

### Input fields

<ParamField path="finding_name" type="string" required>
  Full finding resource name, e.g. `organizations/&#123;org&#125;/sources/&#123;src&#125;/locations/&#123;loc&#125;/findings/&#123;id&#125;`. The scope prefix decides which IAM permissions are checked, so pass `canonicalName` from `list_findings` if you hold project-level access; `name` is always organization-scoped.
</ParamField>

<ParamField path="state" type="string" required>
  New finding state: `ACTIVE` or `INACTIVE`. To silence an accepted risk rather than mark it fixed, use `mute_finding`.
</ParamField>