Integrate Prisma Cloud with Google Cloud Security Command Center (SCC)

The service account you use to onboard the GCP Organization in to Prisma Cloud should include Viewer, Organization Viewer, and Security Center Findings Editor roles.

To view assets and findings on the Cloud SCC console, enable the

Cloud Security Command Center API

.

Go to the GCP Console API Library and select your GCP project.
Make sure to enable the
Cloud Security Command Center API
in the project owns the Service Account that you will use to onboard the GCP Organization into Prisma Cloud.
Enable APIs and Services
.
Enable the
Cloud Security Command Center API
.

Sign up for the Prisma Cloud SCC solution on the Google console.

A security center administrator can set up this integration on the Google console.

Go to the Google Console and search for
Prisma Cloud CSCC
.
Visit Palo Alto Networks site to Signup
.

Select the organization that you onboarded in to Prisma Cloud.
Select the
Service account
you used to onboard the GCP Organization.

Copy the
Source ID
. You need the
Source ID
when you set up this integration in Prisma Cloud.
Click
Done
.

Set up Google Cloud SCC as one of the integration channels in Prisma Cloud.

Log in to Prisma Cloud.
Select
Settings
Integrations
.
Create a
+New Integration
.
Select
CSCC
as the
Integration Type
.
Specify a meaningful
Integration Name
and
Description
.
Enter the
Source ID
that you copied Prisma Cloud

Select the
GCP Organization
.
Click
Next
and then
Test
.
For a successful integration, you must configure adequate permissions for the service account (as listed above). After you successfully set up the integration, the status
Settings
Integrations
) turns red when there are any issues and green when there are no issues or all issues are resolved.

Create an Alert Rule for Run-Time Checks or modify an existing rule to send alerts to Google Cloud SCC. See Send Prisma Cloud Alert Notifications to Third-Party Tools.

View alerts in Cloud SCC.

Go to the Google Console and select

Security

Security Command Center

.



Click

Findings

to view the alerts.



Select the rule to see the details about the alerts.