Controlar o acesso aos recursos nas páginas do console do Security Operations
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
O nível Enterprise do Security Command Center inclui alguns recursos disponíveis
no Google Security Operations. Você vai investigar e corrigir vulnerabilidades,
configurações incorretas e ameaças usando as páginas do
console doGoogle Cloud e do console do Security Operations.
Os usuários do Security Command Center Enterprise precisam de permissões do IAM para acessar
os recursos do Security Command Center nas páginas do console Google Cloud e do console de operações de segurança.
O Google Security Operations tem um conjunto de papéis predefinidos do IAM que permitem
acessar
recursos relacionados ao SIEM
e
recursos relacionados ao SOAR
nas páginas do console do Security Operations. É possível conceder os papéis do Google Security Operations no nível do projeto.
O Security Command Center tem um conjunto de papéis predefinidos do IAM que permitem
acessar recursos nas páginas do console do Security Operations exclusivos do nível
Security Command Center Enterprise. Isso inclui o seguinte:
Para acessar os recursos do Security Command Center disponíveis nas páginas do console do Security Operations,
os usuários precisam ter pelo menos o papel Leitor administrador da Central de segurança (roles/securitycenter.adminViewer). Conceda os papéis do Security Command Center no nível da organização.
Ao planejar a implantação, revise o seguinte para identificar quais usuários precisam de acesso aos recursos:
Para conceder acesso do usuário a recursos e descobertas no console Google Cloud ,
consulte Controle de acesso com o IAM.
Para conceder aos usuários acesso aos recursos de resposta relacionados ao SOAR nas páginas do console do Security Operations,
consulte Mapear papéis do IAM no lado do SOAR do console do Security Operations.
Você também mapeia os papéis do IAM relacionados à SOAR para papéis do SOC, grupos de permissões e ambientes em Configurações da SOAR.
Para acessar os recursos disponíveis com o Security Command Center Enterprise, como a
página "Visão geral da postura",
conceda aos usuários os papéis do IAM necessários
na organização em que o Security Command Center Enterprise está ativado.
As etapas para conceder acesso a recursos variam de acordo com a configuração do provedor
de identidade.
Se você usa o Google Workspace ou o Cloud Identity como provedor de identidade,
concede papéis diretamente a um usuário ou grupo. Consulte
Configurar um Google Cloud provedor de identidade
para ver um exemplo de como fazer isso.
Se você usa a federação de identidade da força de trabalho para se conectar a um provedor de identidade de terceiros (como Okta ou Azure AD), conceda papéis a identidades em um pool de identidades da força de trabalho ou a um grupo dentro desse pool.
Verifique se os pools de força de trabalho incluem permissões para acessar
recursos específicos do Security Command Center nas páginas do console do Security Operations. Confira alguns exemplos:
Para conceder o papel de Leitor administrador da Central de segurança a todos os usuários em um pool de
identidades da força de trabalho, execute o seguinte comando:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThe Security Command Center Enterprise tier includes certain features available\nfrom Google Security Operations. You investigate and remediate vulnerabilities,\nmisconfigurations, and threats using both\n[Google Cloud console and Security Operations console](/security-command-center/docs/scce-consoles-overview)\npages.\n\nSecurity Command Center Enterprise users need IAM permissions to access\nSecurity Command Center features in both the Google Cloud console and Security Operations console\npages.\n\nGoogle Security Operations has a set of predefined IAM roles that let\nyou access\n[SIEM-related features](/chronicle/docs/onboard/configure-feature-access#overview-perm-role)\nand\n[SOAR-related features](/security-command-center/docs/map-users-in-secops#grant-iam-roles-in-the-google-cloud-console)\nin Security Operations console pages. You can grant the Google Security Operations roles\nat the project level.\n\nSecurity Command Center has a set of predefined IAM roles that let you\naccess features in Security Operations console pages that are unique to the\nSecurity Command Center Enterprise tier. These include the following:\n\n- [Security Center Admin Editor Viewer (`roles/securitycenter.adminEditor`)](/iam/docs/understanding-roles#securitycenter.adminEditor)\n- [Security Center Admin Viewer (`roles/securitycenter.adminViewer`)](/iam/docs/understanding-roles#securitycenter.adminViewer)\n\nTo view Security Command Center features available in Security Operations console pages,\nusers need at least the **Security Center Admin Viewer** (`roles/securitycenter.adminViewer`)\nrole. Grant the Security Command Center roles at the organization level.\n\nAs you plan the deployment, review the following to identify which users need\naccess to features:\n\n- To grant user access to features and findings in the Google Cloud console,\n see [Access control with IAM](/security-command-center/docs/access-control).\n\n- To grant user access to SIEM-related threat detection and investigation\n features in Security Operations console pages, see\n [Configure feature access control using IAM](/chronicle/docs/onboard/configure-feature-access#overview-perm-role).\n\n- To grant users access to SOAR-related response features in Security Operations console pages,\n see [Map IAM roles in the SOAR side of the Security Operations console](/security-command-center/docs/map-users-in-secops).\n You also map the SOAR-related IAM roles to SOC roles,\n permission groups, and environments under **SOAR settings**.\n\n- To create custom IAM roles using Google SecOps\n IAM permissions, see\n [Create and assign a custom role to a group](/chronicle/docs/onboard/configure-feature-access#custom-role).\n\n- To access features available with Security Command Center Enterprise, such as the\n [Posture Overview page](/security-command-center/docs/toxic-combinations-manage#view_an_overview_of_all_toxic_combination_cases),\n grant users the [required IAM roles](/security-command-center/docs/how-to-use-security-command-center#required_permissions)\n in the organization where Security Command Center Enterprise is activated.\n\nThe steps to grant access to features is different depending on the identity\nprovider configuration.\n\n- If you use Google Workspace or Cloud Identity as the identity provider,\n you grant roles directly to a user or group. See\n [Configure a Google Cloud identity provider](/chronicle/docs/onboard/configure-cloud-authentication)\n for an example of how to do this.\n\n- If you use Workforce Identity Federation to connect to a third-party identity\n provider (such as Okta or Azure AD), you grant roles to identities in a\n workforce identity pool or to a group within the workforce identity pool.\n\n See [Configure feature access control using IAM](/chronicle/docs/onboard/configure-feature-access)\n for examples of how to grant SIEM-related features and SOAR-related features\n to a workforce identity pool.\n\n Make sure the workforce pools include permissions to access\n Security Command Center-specific features in Security Operations console pages. The following\n are examples:\n - To grant the Security Center Admin Viewer role to all users in a workforce\n identity pool, run the following command:\n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --role roles/securitycenter.adminViewer \\\n --member \"principalSet://iam.googleapis.com/locations/global/workforcePools/\u003cvar translate=\"no\"\u003eWORKFORCE_POOL_ID\u003c/var\u003e/*\" \\\n --condition None\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the numeric organization ID.\n - \u003cvar translate=\"no\"\u003eWORKFORCE_POOL_ID\u003c/var\u003e: the value you defined for the workforce identity pool ID.\n - To grant the Security Center Admin Viewer roles to a specific group, run the following commands:\n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --role roles/securitycenter.adminViewer \\\n --member \"principalSet://iam.googleapis.com/locations/global/workforcePools/\u003cvar translate=\"no\"\u003eWORKFORCE_POOL_ID\u003c/var\u003e/group/\u003cvar translate=\"no\"\u003eGROUP_ID\u003c/var\u003e\" \\\n --condition None\n\n Replace \u003cvar translate=\"no\"\u003eGROUP_ID\u003c/var\u003e: a group in the mapped `google.groups` claim."]]
