Integrate Prisma Cloud with Google Cloud Security Command Center (SCC)

Verify the permissions for the service account you use to onboard the GCP Organization on Prisma Cloud.

The Viewer, Organization Viewer, and Security Center Findings Editor roles are required.

Enable the APIs required to view assets and findings on the Cloud SCC console.

Go to the GCP Console API Library and select your GCP project.
Make sure to enable these APIs in the project that owns the Service Account, which you will use to onboard the GCP Organization on Prisma Cloud.
Select
Enable APIs and Services
.
Enable the
Cloud Security Command Center API
.
Enable the
Identity and Access Management (IAM) API
.
The service account must also include the
iam.serviceAccounts.signJwt
permission for the integration.

Sign up for the Prisma Cloud SCC solution on the Google console.

A security center administrator can set up this integration on the Google console.

Go to the Google Console and search for
Prisma Cloud CSCC
.
Visit Palo Alto Networks site to Signup
.

Select the organization that you onboarded in to Prisma Cloud.
Select the
Service account
you used to onboard the GCP Organization.

Copy the
Source ID
. You need the
Source ID
when you set up this integration in Prisma Cloud.
Click
Done
.

Set up Google Cloud SCC as one of the integration channels in Prisma Cloud.

Log in to Prisma Cloud.
Select
Settings
Integrations
.
Add Integration
Google CSCC
. A modal wizard opens where you can add the CSCC integration.
Enter
Integration Name
and
Description
.
Enter the
Source ID
that you copied from Google.

Select the
GCP Organization
.
Next
and then
Test
. Review the Summary and
Save
.
For a successful integration, you must configure adequate permissions for the service account (as listed above). After you successfully set up the integration, the status (
Settings
Integrations
) turns red when there are any issues and green when there are no issues or all issues are resolved.

Create an Alert Rule for Run-Time Checks or modify an existing rule to send alerts to Google Cloud SCC. See Send Prisma Cloud Alert Notifications to Third-Party Tools.

View alerts in Cloud SCC.

Go to the Google Console and select

Security

Security Command Center

.



Click

Findings

to view the alerts.



Select the rule to see the details about the alerts.