Manage mute rules

Console

Define the mute rule

1. In the Google Cloud console, go to the Findings page.

   Go to Findings

2. Select an organization or project.

3. Click Mute options, and then select Manage mute rules.

4. Click Create mute rule.

5. Enter a Mute rule ID.

6. Recommended: Enter a Description that provides context for why findings are muted.

7. To confirm the scope of the mute rule, check the Parent resource value.

Optional: Add an expiration date

You can add an expiration date to dynamic mute rules.

1. Select Mute matching findings temporarily.

2. To configure the expiration date for the dynamic mute rule, select the calendar and choose a date and time at least 24 hours in the future.

   After the expiration date, the mute rule has no effect.

Optional: Limit the mute rule with a query

If you add a query, then the mute rule applies only to findings that match the query.

To limit the mute rule with a query, in the Findings query section, click add_circle_outline Add filter.

The Add filter menu lets you choose supported finding attributes and values.

1. In the Select filter menu, select a finding attribute or type its name in the Search finding attributes box. A list of the available sub-attributes displays.
2. Select a sub-attribute. A selection field displays where you can build the query statement using the sub-attribute you selected, a query operator, and one or more values for the sub-attribute.

3. Select the operator and one or more values for the sub-attribute from the panel. For more information about query operators and functions that they use, see Query operators in the Add filters menu.

   If you want to start over, click Reset.

4. Click Apply.

   The menu closes and your query is updated.

5. Repeat until the findings query contains all the attributes you want.

If the query doesn't match the correct findings, then revise the query as needed and preview the findings again. Repeat this step until you're satisfied with the results.

Save the mute rule

Click Save. The Google Cloud console shows a list of your mute rules.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To create mute rules, run the gcloud scc muteconfigs create command:

   gcloud scc muteconfigs create CONFIG_ID \
     --PARENT=PARENT_ID \
     --location=LOCATION \
     --description="RULE_DESCRIPTION" \
     --filter="FILTER" \
     --type=MUTE_TYPE \
     --expiry-time=TIMESTAMP

   Replace the following:

   • CONFIG_ID: the name of the mute rule. The ID must use alphanumeric characters and hyphens and be between 1 and 63 characters.
   • PARENT: the scope in the resource hierarchy to which the mute rule applies, organization, folder, or project.
   • PARENT_ID: the numeric ID of the parent organization, folder, or project, or the alphanumeric ID of the parent project.
   • LOCATION: the Security Command Center location in which to manage mute rules; if data residency is enabled, use eu, sa, or us; otherwise, use the value global.
   • RULE_DESCRIPTION: a description of the mute rule of no more than 1,024 characters.
   • FILTER: the expression you define to filter findings. For example, to mute OPEN_FIREWALL findings, your filter can be FILTER="category=\"OPEN_FIREWALL\"".
   • MUTE_TYPE: the type of mute rule you want to create. Valid mute rule types are DYNAMIC and STATIC. The mute rule type is set to STATIC by default. You can't change the type of a mute rule after you've created it.
   • TIMESTAMP: only applies if you are creating a dynamic mute rule. The date and time string that indicates when the dynamic mute rule expires. The value must be set to at least one day in the future or the request will be rejected. For information about time formats, see gcloud topic datetimes. When a dynamic mute rule expires, it is removed from all matched findings. To have the dynamic mute rule act indefinitely on matching findings, omit this field.

   The response includes the mute rule ID, which you can use to view, update, and delete mute rules, as described in Manage mute rules.

Terraform

Create a mute rule for an organization:

resource "google_scc_v2_organization_mute_config" "default" {
  mute_config_id    = "my-config"
  organization = "123456789"
  location     = "global"
  description  = "My custom Cloud Security Command Center Finding Organization mute Configuration"
  filter = "severity = \"HIGH\""
  type = "STATIC"
}

Create a mute rule for a folder:

resource "google_folder" "folder" {
  parent       = "organizations/123456789"
  display_name = "folder-name"
}

resource "google_scc_v2_folder_mute_config" "default" {
  mute_config_id    = "my-config"
  folder = google_folder.folder.folder_id
  location     = "global"
  description  = "My custom Cloud Security Command Center Finding Folder mute Configuration"
  filter = "severity = \"HIGH\""
  type = "STATIC"
}

Create a mute rule for a project:

resource "google_scc_v2_project_mute_config" "default" {
  mute_config_id    = "my-config"
  project = "my-project-name"
  location     = "global"
  description  = "My custom Cloud Security Command Center Finding Project mute Configuration"
  filter = "severity = \"HIGH\""
  type = "STATIC"
}

Go

import (
	"context"
	"fmt"
	"io"

	securitycenter "cloud.google.com/go/securitycenter/apiv2"
	"cloud.google.com/go/securitycenter/apiv2/securitycenterpb"
)

// createMuteRule: Creates a mute configuration under a given scope that will mute
// all new findings that match a given filter.
// Existing findings will not be muted.
func createMuteRule(w io.Writer, parent string, muteConfigId string) error {
	// parent: Use any one of the following options:
	//             - organizations/{organization_id}
	//             - folders/{folder_id}
	//             - projects/{project_id}
	// parent := fmt.Sprintf("projects/%s", "your-google-cloud-project-id")
	// muteConfigId: Set a random id; max of 63 chars.
	// muteConfigId := "random-mute-id-" + uuid.New().String()
	ctx := context.Background()
	client, err := securitycenter.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("securitycenter.NewClient: %w", err)
	}
	defer client.Close()

	muteConfig := &securitycenterpb.MuteConfig{
		Description: "Mute low-medium IAM grants excluding 'compute' ",
		// Set mute rule(s).
		// To construct mute rules and for supported properties, see:
		// https://cloud.google.com/security-command-center/docs/how-to-mute-findings#create_mute_rules
		Filter: "severity=\"LOW\" OR severity=\"MEDIUM\" AND " +
			"category=\"Persistence: IAM Anomalous Grant\" AND " +
			"-resource.type:\"compute\"",
		Type: securitycenterpb.MuteConfig_STATIC,
	}

	req := &securitycenterpb.CreateMuteConfigRequest{
		Parent:       parent,
		MuteConfigId: muteConfigId,
		MuteConfig:   muteConfig,
	}

	response, err := client.CreateMuteConfig(ctx, req)
	if err != nil {
		return fmt.Errorf("failed to create mute rule: %w", err)
	}
	fmt.Fprintf(w, "Mute rule created successfully: %s", response.Name)
	return nil
}

Java

import com.google.cloud.securitycenter.v2.LocationName;
import com.google.cloud.securitycenter.v2.MuteConfig;
import com.google.cloud.securitycenter.v2.MuteConfig.MuteConfigType;
import com.google.cloud.securitycenter.v2.SecurityCenterClient;
import java.io.IOException;
import java.util.UUID;

public class CreateMuteRule {

  public static void main(String[]