Skip to main content

​
Pre-requisites

User Organization must define Owner or Security Admin role (roles/owner or roles/securitycenter.admin) in your GCP organization.
User must have Organization Admin permissions to enable services at the organization level.
  1. Select your organization, and enter keyword “Security” in the search bar.
  2. Select the Security Command Center.
    GCPSCC3 1
  3. Click on “GET THE SECURITY COMMAND CENTER”.
  4. Make sure Service Tier is Premium (Paid) for your organization.

    SCC Editions: Standard vs. Premium Feature support (For reference)
AirMDR uses a Google Cloud service account JSON key to authenticate with Security Command Center.

​
Required Authentication Details

The service account must have permission to read Security Command Center findings from the target organization.Recommended minimum role:Additional roles may be required depending on the customer’s GCP hierarchy, organization policies, and AirMDR use case.
Use least-privilege access. Assign only the permissions required for AirMDR to retrieve Security Command Center findings.

​
Setup Steps

This section explains how to collect the two required values for AirMDR:
  • service_account_json
  • organization_id
1

Open Google Cloud Console

  1. Sign in to the Google Cloud Console.
  2. In the ribbon, click on your project name.
  3. From the top project selector, select the project that will be used for the AirMDR integration.
    Confirm that you are working under the correct organization and project.
    The selected project is where the service account and API configuration will be managed.
2

Enable Security Command Center API

  1. In Google Cloud Console, open the navigation menu.
  2. Go to APIs & Services.
  3. Select Library.
  4. Search for Security Command Center API.
  5. Open the API page.
  6. Click Enable.
3

Create a Service Account

  1. In Google Cloud Console, open the navigation menu.
  2. Go to IAM & Admin.
  3. Select Service Accounts.
  4. Click Create Service Account.
  5. Enter the following details:
  6. Click Create and Continue.
  7. Skip role assignment (Permissions and Principals with access) at this step if the role will be assigned at the organization level.
  8. Click Done.
4

Generate the Service Account JSON Key

  1. Search the service account created for AirMDR.
    For example: airmdr-integration-gcp(as shown)
    GCP14 1
  2. Open the Keys tab.
  3. Click Add Key drop-down.
    GCP13 1
  4. Select Create new key.
  5. Select JSON as the key type.
    GCP12
  6. Click Create.
    Permission updates for service accounts may take a few minutes to propagate. If access is not granted immediately, wait a few minutes and try again.
  7. The JSON file is downloaded automatically.
    The downloaded file is the service_account_json required in AirMDR.
    Example JSON Structure:
    GCP16
    Store the JSON key securely. Do not share it over email, chat, or unsecured channels.
5

Assign IAM Role to the Service Account

  1. In Google Cloud Console, go to IAM & Admin.
  2. Select IAM.
    Make sure the correct organization is selected.
    GCPSCC7 3
  3. Click Grant Access.
    GCPSCC6 1
  4. In Add Principals → New principals, enter the service account email.
    Example: airmdr-integration-gcp@example-project.iam.gserviceaccount.com
  5. In Assign Roles → Select a role, search for and select:
    • Security Center Findings Viewer (roles/securitycenter.viewer) → Grants read access
      Make sure the correct Organisation is selected under Resource.
      For example: airmdr.com (Reference only as shown below)
  6. Click Save.
    GCP11 1
When finished, you should have a service account named airmdr-agent, credentials for this service account in a JSON file saved to your host.
6

Get the Organization ID

  1. In Google Cloud Console, open the project selector at the top.
    GCPSCC7 2
  2. Select the required organization.
  3. Click the three-dot menu or More option.
  4. Select Settings.
  5. Locate the Organization ID field.
  6. Copy the numeric organization ID.
    Example: 123456789012
    This value is the organization_id required in AirMDR.

​
Configure GCP Security Command Center API in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “Google Cloud Provider”, select the Connections tab, and click + Create button.
  4. Enter an unique name to the Instance (e.g., your org name-GCP) to easily identify the user connection by AirMDR.
  5. Enter the application credentials like Service_account_json and Organization_id in the Authentication Details field params, and click Save.

​
Skills provided by this Integration

To view the details of Input Parameters and Output for the respective skills

​
Additional Information

Where to MonitorSample Success Log
Sample Error Log
Recommended Log Levels
Follow these recommendations to maintain a secure and compliant Google Cloud Security Command Center (GCP SCC) integration with AirMDR.✅ Do
  • Use a dedicated Service Account for the AirMDR integration.
  • Grant only the minimum IAM permissions required (principle of least privilege).
  • Store the Service Account JSON securely in an encrypted secrets manager or credential vault.
  • Rotate Service Account keys periodically according to your organization’s security policy.
  • Enable Multi-Factor Authentication (MFA) for privileged Google Cloud accounts.
  • Regularly review IAM roles and remove unnecessary permissions.
  • Monitor Google Cloud Audit Logs for authentication and permission changes.
  • Validate the integration after updating IAM roles or rotating credentials.
  • Keep the Security Command Center API enabled and accessible.
  • Immediately revoke compromised or unused Service Account keys.
❌ Don’t
  • Don’t share the Service Account JSON file over email, chat, or unsecured channels.
  • Don’t commit Service Account keys to source code repositories.
  • Don’t assign excessive permissions such as Owner or Editor unless absolutely necessary.
  • Don’t reuse the same Service Account across multiple unrelated applications.
  • Don’t leave unused Service Account keys active.
  • Don’t disable audit logging for Service Account activities.
  • Don’t expose Organization IDs or sensitive credentials in public documentation or screenshots.
  • Don’t hardcode credentials in scripts or configuration files.
  • Don’t ignore authentication or permission-related errors during integration validation.
  • Don’t skip periodic access reviews and credential rotation.
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly.
  • 🔄 Reconnect in AirMDR when secrets are changed.
Data ExchangedSecurity Considerations
  • Authentication is performed using a Google Cloud service account.
  • API communication uses Google Cloud HTTPS endpoints.
  • Store the service account JSON securely.
  • Rotate the JSON key based on the organization’s credential rotation policy.
  • Revoke unused keys immediately.
Ports and Endpoints