GoogleCloudSCCMuteFinding
This Script is part of the Google Cloud SCC Pack.#
Supported versions
Available on Cortex XSOAR (versions 6.10.0 and later) and Cortex XSIAM.
Mutes a Google Cloud Security Command Center finding by its finding name, using the google-cloud-scc-finding-mute command of the Google Cloud SCC integration.
The script is designed to be used as an action button on the Google Cloud SCC Finding incident layout. When the finding_name argument is not provided, the finding name is taken from the GoogleCloudSCC Finding Name incident field, so the button can be clicked without providing any input.
After the finding is muted, the mute state returned by the command (MUTED when the response does not contain it) is written to the GoogleCloudSCC Finding Mute Status incident field using the setIncident command.
Script Data#
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | incident-action-button |
| Cortex XSOAR Version | 6.10.0 |
Dependencies#
This script uses the following commands and scripts.
- google-cloud-scc-finding-mute
- setIncident
An enabled Google Cloud SCC integration instance is required. The GoogleCloudSCC Finding Mute Status incident field is part of this pack and must be associated with the incident type of the incident.
Inputs#
| Argument Name | Description | Required |
|---|---|---|
| finding_name | The relative resource name of the finding to mute. In the v2 API the name may include an optional "locations/{location}" segment. If no location is specified, the finding is assumed to be in "global". Format: organizations/{organization_id}/sources/{source_id}/findings/{findingId} or organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{findingId} Example: organizations/595779152576/sources/14801394649435054450/locations/global/findings/bc5a86da657611ebb979005056a5924e. If not provided, the value of the "GoogleCloudSCC Finding Name" incident field is used. | Optional |
Outputs#
| Path | Type | Description |
|---|---|---|
| GoogleCloudSCC.FindingV2.name | String | The relative resource name of this finding. Format: organizations/{organization}/sources/{source}/locations/{location}/findings/{finding}. |
| GoogleCloudSCC.FindingV2.canonicalName | String | The canonical name of the finding, always suffixed with the region-agnostic (global) resource path. |
| GoogleCloudSCC.FindingV2.parent | String | The relative resource name of the source the finding belongs to. |
| GoogleCloudSCC.FindingV2.resourceName | String | The full resource name of the Google Cloud resource this finding is for, for findings on Google Cloud resources. |
| GoogleCloudSCC.FindingV2.state | String | The state of the finding (ACTIVE or INACTIVE). |
| GoogleCloudSCC.FindingV2.category | String | The additional taxonomy group within findings from a given source. |
| GoogleCloudSCC.FindingV2.severity | String | The severity of the finding (CRITICAL, HIGH, MEDIUM, LOW). |
| GoogleCloudSCC.FindingV2.mute | String | The mute state of the finding (MUTED, UNMUTED, UNDEFINED). |
| GoogleCloudSCC.FindingV2.muteInitiator | String | The additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding. |
| GoogleCloudSCC.FindingV2.muteUpdateTime | Date | The time at which the finding was muted or unmuted, in ISO 8601 format (e.g., 2026-09-15T12:34:56Z). |
| GoogleCloudSCC.FindingV2.eventTime | Date | The time the finding was first detected, in ISO 8601 format (e.g., 2026-09-15T12:34:56Z). |
| GoogleCloudSCC.FindingV2.createTime | Date | The time at which the finding was created in Security Command Center, in ISO 8601 format (e.g., 2026-09-15T12:34:56Z). |
| GoogleCloudSCC.FindingV2.externalUri | String | The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. |
Use as an Incident Action Button#
The script is already wired to the Mute Finding button of the Google Cloud SCC Finding incident layout. To add the button to a different layout:
- Go to Settings > Objects Setup > Incidents > Layouts and edit the required layout.
- Drag a Buttons section item to the required section.
- Set Label to
Mute Finding. - Set Script to
GoogleCloudSCCMuteFinding. - Leave the script arguments empty to mute the finding of the incident, or set
finding_nameto${incident.googlecloudsccfindingname}explicitly. - Save the layout.
Clicking the button mutes the finding of the incident and posts the result to the incident War Room.
Script Example#
!GoogleCloudSCCMuteFinding finding_name="organizations/1094826489209/sources/5629340921983475201/locations/global/findings/6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a"
Context Example#
Human Readable Output#
The finding has been muted successfully#
Organization ID Name Mute State Severity Category Event Time (In UTC) Create Time (In UTC) External Uri Resource Name 1094826489209 organizations/1094826489209/sources/5629340921983475201/locations/global/findings/6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a MUTED ACTIVE CRITICAL Malware: Cryptomining Bad IP February 18, 2020 at 07:26:42 AM February 19, 2020 at 01:37:43 PM https://console.cloud.google.com/compute/instancesDetail/zones/us-central1-a/instances/web-server-01?project=prod-webapp-284917 //compute.googleapis.com/projects/prod-webapp-284917/zones/us-central1-a/instances/web-server-01