Integrate Prisma Cloud with Google Cloud Security Command Center (SCC)

Verify the permissions for the service account you use to onboard the GCP Organization on Prisma Cloud.

The Viewer, Organization Viewer, and Security Center Findings Editor roles are required.

Enable the APIs required to view assets and findings on the Cloud SCC console.

Go to the GCP Console API Library and select your GCP project.
Make sure to enable these APIs in the project that owns the Service Account, which you will use to onboard the GCP Organization on Prisma Cloud.
Select
Enable APIs and Services
.
Enable the
Cloud Security Command Center API
.
Enable the
Identity and Access Management (IAM) API
.
The service account must also include the iam.serviceAccounts.signJwt permission for the integration.

Sign up for the Prisma Cloud SCC solution on the Google console.

A security center administrator can set up this integration on the Google console.

Go to the Google Console and search for
Prisma Cloud CSCC
.
Visit Palo Alto Networks site to Signup
.

Select the organization that you onboarded in to Prisma Cloud.
Select the
Service account
you used to onboard the GCP Organization.

Copy the
Source ID
. You need the
Source ID
when you set up this integration in Prisma Cloud.
Click
Done
.

Set up Google Cloud SCC as one of the integration channels in Prisma Cloud.

Log in to Prisma Cloud.

Select

Settings

Integrations

.

Add Integration

Google CSCC

. A modal wizard opens where you can add the CSCC integration.

Enter

Integration Name

and

Description

.

Enter the

Source ID

that you copied from Google.



Select the

GCP Organization

.

Next

and then

Test

. Review the Summary and

Save

.

For a successful integration, you must configure adequate permissions for the service account (as listed above). After you set up the integration successfully, you can use the Get Status link in

Settings

Integrations

to periodically check the integration status.



Create an Alert Rule for Run-Time Checks or modify an existing rule to send alerts to Google Cloud SCC. See Send Prisma Cloud Alert Notifications to Third-Party Tools.

View alerts in Cloud SCC.

Go to the Google Console and select

Security

Security Command Center

.



Click

Findings

to view the alerts.



Select the rule to see the details about the alerts.