Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan cara mengelompokkan temuan ke dalam kasus.
Langkah-langkah ini dilakukan menggunakan halaman konsol Operasi Keamanan.
Untuk membuka halaman ini dari konsol Google Cloud , buka
Setelan > Setelan SOAR.
Ringkasan
Mekanisme pengelompokan temuan secara otomatis mengelompokkan temuan yang di-ingest ke dalam kasus. Secara default, mekanisme pengelompokan ini memastikan bahwa semua temuan dalam kasus
termasuk dalam:
Pemilik fasilitas
Google Cloud project
Akun AWS
Jenis aset
Kategori
Tingkat keparahan
Mengonfigurasi setelan pengelompokan
Untuk mengonfigurasi setelan pengelompokan default yang berlaku untuk semua temuan yang di-ingest,
ikuti langkah-langkah berikut:
Di konsol Operasi Keamanan, buka Setelan > Penyerapan
> Konektor.
Untuk menyesuaikan mekanisme pengelompokan dan menonaktifkan opsi pengelompokan tertentu, hapus centang pada kotak untuk satu atau beberapa parameter berikut:
Group by AWS Account
Group by GCP Project
Group by Severity
Group by Asset Type
Secara default, setelan pengelompokan berikut berlaku untuk temuan yang di-ingest:
Kelompokkan menurut Akun AWS: Temuan dikelompokkan menurut akun AWS yang terkait.
Kelompokkan menurut Project GCP: Temuan dikelompokkan menurut project tempat temuan tersebut berada. Google Cloud
Kelompokkan menurut Tingkat Keparahan: Temuan dikelompokkan menurut severitytingkat,
seperti HIGH atau MEDIUM.
Kelompokkan menurut Jenis Aset: Temuan dikelompokkan menurut jenis asetnya (Google Cloud jenis resource),
seperti instance Compute Engine atau akun layanan IAM.
Semua temuan yang dikelompokkan ke dalam kasus dimiliki oleh pemilik yang sama. Untuk memastikan
temuan dikelompokkan dengan benar, termasuk temuan tanpa tag
Google Cloud yang diwarisi atau Kontak Penting, selalu konfigurasi parameter
konektor Fallback Owner.
Contoh: Cara kerja mekanisme pengelompokan
Dalam contoh ini, hanya temuan dari Google Cloud yang digunakan.
Konektor menyerap empat temuan dengan tingkat keparahan yang berbeda dan nilai yang berbeda yang diwarisi dari resource Google Cloud masing-masing:
Temuan 1: Tingkat Keparahan: Critical, Jenis Aset: Compute, Project: Project_1
Temuan 2: Tingkat Keparahan: Critical, Jenis Aset: IAM, Project: Project_2
Temuan 3: Tingkat Keseriusan: High, Jenis Aset: Compute, Project: Project_1
Temuan 4: Tingkat Keparahan: High, Jenis Aset: Compute, Project: Project_2
Mekanisme pengelompokan default
Setelan default berarti temuan dikelompokkan menurut masing-masing project, jenis aset, dan properti tingkat keparahan.
Dalam contoh ini, setiap temuan disertakan dalam kasus yang berbeda.
Kasus 1:
Temuan 1: Tingkat Keparahan: Critical, Jenis Aset: Compute,
Project: Project_1
Kasus 2:
Temuan 2: Tingkat Keparahan: Critical, Jenis Aset: IAM, Project:
Project_2
Kasus 3:
Temuan 3: Tingkat Keseriusan: High, Jenis Aset: Compute, Project:
Project_1
Kasus 4:
Temuan 4: Tingkat Keparahan: High, Jenis Aset: Compute, Project:
Project_2
Mekanisme pengelompokan kustom
Jika hanya memilih kotak centang Group by GCP Project, temuan akan otomatis dikelompokkan menurut projectnya sehingga kasus hanya berisi temuan yang termasuk dalam project yang sama: Google Cloud
Kasus 1:
Temuan 1: Tingkat Keparahan Critical, Jenis Aset: Compute, Project:
Project_1
Temuan 3: Tingkat Keparahan High, Jenis Aset: Compute, Project:
Project_1
Kasus 2:
Temuan 2: Tingkat Keparahan Critical, Jenis Aset: IAM, Project:
Project_2
Temuan 4: Tingkat Keparahan High, Jenis Aset: Compute, Project:
Project_2
Jika hanya memilih kotak centang Kelompokkan menurut Tingkat Keparahan, temuan akan otomatis dikelompokkan menurut tingkat keparahannya sehingga kasus hanya berisi temuan dengan tingkat keparahan yang sama:
Kasus 1:
Temuan 1: Tingkat Keparahan: Critical, Jenis Aset: Compute, Project:
Project_1
Temuan 2: Tingkat Keparahan: Critical, Jenis Aset: IAM, Project:
Project_2
Kasus 2:
Temuan 3: Tingkat Keseriusan: High, Jenis Aset: Compute, Project:
Project_1
Temuan 4: Tingkat Keparahan: High, Jenis Aset: Compute, Project:
Project_2
Dengan hanya mencentang kotak Kelompokkan menurut Jenis Aset, temuan akan otomatis dikelompokkan menurut jenis asetnya (jenis resource di Google Cloud) sehingga kasus hanya berisi temuan yang termasuk dalam resource yang sama:
Kasus 1:
Temuan 1: Tingkat Keparahan: Critical, Jenis Aset: Compute, Project:
Project_1
Temuan 3: Tingkat Keseriusan: High, Jenis Aset: Compute, Project:
Project_1
Temuan 4: Tingkat Keparahan: High, Jenis Aset: Compute, Project:
Project_2
Kasus 2:
Temuan 2: Tingkat Keparahan: Critical, Jenis Aset: IAM, Project:
Project_2
Memilih kotak centang Kelompokkan menurut Project GCP dan Kelompokkan menurut Tingkat Keparahan akan
mengelompokkan temuan secara otomatis menurut project dan tingkat keparahannya masing-masing
sehingga kasus hanya berisi temuan yang termasuk dalam project yang sama dan
memiliki tingkat keparahan yang sama. Dalam contoh ini, konektor membuat empat kasus berikut:
Kasus 1:
Temuan 1: Tingkat Keparahan: Critical, Jenis Aset: Compute, Project:
Project_1
Kasus 2:
Temuan 2: Tingkat Keseriusan: Critical, Jenis Resource: IAM, Project:
Project_2
Kasus 3:
Temuan 3: Tingkat Keseriusan: High, Jenis Resource: Compute, Project:
Project_1
Kasus 4:
Temuan 4: Tingkat Keseriusan: High, Jenis Resource: Compute, Project:
Project_2
Apa langkah selanjutnya?
Pelajari lebih lanjut notifikasi dalam dokumentasi Google SecOps.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[],[],null,["# Group findings in cases\n\n| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThis document explains how you can group findings into cases.\n\nThese steps are performed using Security Operations console pages.\nTo open these pages from the Google Cloud console, go to\n**Settings \\\u003e SOAR settings**.\n\nOverview\n--------\n\nThe findings grouping mechanism automatically groups ingested findings into\ncases. By default, this grouping mechanism ensures that all findings in a case\nbelong to the same:\n\n- Resource owner\n- Google Cloud project\n- AWS account\n- Asset type\n- Category\n- Severity level\n\nConfigure grouping settings\n---------------------------\n\nTo configure the default grouping settings applicable to all ingested findings,\nfollow these steps:\n\n1. In the Security Operations console, go to **Settings \\\u003e Ingestion\n \\\u003e Connectors**.\n\n2. Select **SCC Enterprise - Urgent Posture Findings Connector**.\n\n3. To customize the grouping mechanism and disable specific grouping options,\n clear the checkboxes for one or more of the following parameters:\n\n - `Group by AWS Account`\n - `Group by GCP Project`\n - `Group by Severity`\n - `Group by Asset Type`\n\n| **Important:** When customizing the grouping mechanism, we recommend to always select the **Group by GCP Project** and **Group by Asset Type** checkboxes and the **Group by AWS Account**, if the latter applies.\n\nBy default, the following grouping settings apply to ingested findings:\n\n- **Group by AWS Account**: Findings are grouped according to the AWS accounts\n they belong to.\n\n- **Group by GCP Project**: Findings are grouped according to the Google Cloud\n projects they belong to.\n\n- **Group by Severity** : Findings are grouped according to their `severity`\n [level](/security-command-center/docs/finding-severity-classifications),\n such as `HIGH` or `MEDIUM`.\n\n- **Group by Asset Type** : Findings are grouped according to their asset\n type (Google Cloud [resource type](/resource-manager/docs/cloud-platform-resource-hierarchy)),\n such as Compute Engine instance or IAM service account.\n\nAll findings that are grouped into a case belong to the same owner. To ensure\nthat findings are grouped correctly, including findings with no inherited\nGoogle Cloud tags or Essential Contacts, always configure the\nconnector `Fallback Owner` parameter.\n\n### Example: How the grouping mechanism works\n\nIn this example, only findings from Google Cloud are used.\n\nThe connector ingests four findings with different severities\nand different values inherited from their respective Google Cloud resources:\n\n- Finding 1: Severity: `Critical`, Asset Type: `Compute`, Project: `Project_1`\n\n- Finding 2: Severity: `Critical`, Asset Type: `IAM`, Project: `Project_2`\n\n- Finding 3: Severity: `High`, Asset Type: `Compute`, Project: `Project_1`\n\n- Finding 4: Severity: `High`, Asset Type: `Compute`, Project: `Project_2`\n\n#### Default grouping mechanism\n\nDefault settings mean that the findings are grouped according to their respective\nprojects, asset types, and severity property.\n\nIn this example, every finding is included in a different case.\n\n- Case 1:\n\n - Finding 1: Severity: **`Critical`** , Asset Type: **`Compute`** , Project: **`Project_1`**\n- Case 2:\n\n - Finding 2: Severity: **`Critical`** , Asset Type: **`IAM`** , Project: **`Project_2`**\n- Case 3:\n\n - Finding 3: Severity: **`High`** , Asset Type: **`Compute`** , Project: **`Project_1`**\n- Case 4:\n\n - Finding 4: Severity: **`High`** , Asset Type: **`Compute`** , Project: **`Project_2`**\n\n#### Custom grouping mechanism\n\nSelecting only the **Group by GCP Project** checkbox automatically groups findings\naccording to their Google Cloud projects so that a case only contains findings\nbelonging to the same project:\n\n- Case 1:\n\n - Finding 1: Severity `Critical`, Asset Type: `Compute`, Project: **`Project_1`**\n - Finding 3: Severity `High`, Asset Type: `Compute`, Project: **`Project_1`**\n- Case 2:\n\n - Finding 2: Severity `Critical`, Asset Type: `IAM`, Project: **`Project_2`**\n - Finding 4: Severity `High`, Asset Type: `Compute`, Project: **`Project_2`**\n\nSelecting only the **Group by Severity** checkbox automatically groups findings\naccording to their severities so that a case only contains findings with the same\nseverity level:\n\n- Case 1:\n\n - Finding 1: Severity: **`Critical`** , Asset Type: `Compute`, Project: `Project_1`\n - Finding 2: Severity: **`Critical`** , Asset Type: `IAM`, Project: `Project_2`\n- Case 2:\n\n - Finding 3: Severity: **`High`** , Asset Type: `Compute`, Project: `Project_1`\n - Finding 4: Severity: **`High`** , Asset Type: `Compute`, Project: `Project_2`\n\nSelecting only the **Group by Asset Type** checkbox automatically groups findings\naccording to their asset types (resource types in Google Cloud) so that a case\nonly contains findings belonging to the same resource:\n\n- Case 1:\n\n - Finding 1: Severity: `Critical`, Asset Type: **`Compute`** , Project: `Project_1`\n - Finding 3: Severity: `High`, Asset Type: **`Compute`** , Project: `Project_1`\n - Finding 4: Severity: `High`, Asset Type: **`Compute`** , Project: `Project_2`\n- Case 2:\n\n - Finding 2: Severity: `Critical`, Asset Type: **`IAM`** , Project: `Project_2`\n\nSelecting both **Group by GCP Project** and **Group by Severity** checkboxes\nautomatically groups findings according to their respective projects and severity\nlevels so that a case only contains findings belonging to the same project *and*\npossessing the same severity. In this example, the connector creates four\nfollowing cases:\n\n- Case 1:\n\n - Finding 1: Severity: **`Critical`** , Asset Type: `Compute`, Project: **`Project_1`**\n- Case 2:\n\n - Finding 2: Severity: **`Critical`** , Resource Type: `IAM`, Project: **`Project_2`**\n- Case 3:\n\n - Finding 3: Severity: **`High`** , Resource Type: `Compute`, Project: **`Project_1`**\n- Case 4:\n\n - Finding 4: Severity: **`High`** , Resource Type: `Compute`, Project: **`Project_2`**\n\nWhat's next?\n------------\n\n- Learn more about [alerts](/chronicle/docs/soar/investigate/working-with-alerts/whats-on-the-alert-overview-tab) in the Google SecOps documentation."]]
