> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Security Center

> Integrate with Google Cloud Security Command Center (SCC) to ingest findings

<Info>Wirespeed integrates with Google Cloud Security Command Center (SCC) to collect security findings from your Google Cloud organization.</Info>

## Prerequisites

* Access to a Google Cloud organization
* Google Cloud Security Command Center enabled in your organization
* Organization-level permissions to grant **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`)
* One of the following authentication options:
  * A service account key in JSON format
  * A Workload Identity Federation pool/provider configured for Wirespeed's AWS role

## Setup Instructions

Choose one authentication method: **Service account key** or **Workload Identity Federation**.

## Option A: Service Account Key

### Step 1: Create a Service Account in a Project

1. Navigate to the [Google Cloud Console](https://console.cloud.google.com/)
2. Select a **Project** from the project dropdown (top left) - this can be any project within your organization
3. Go to **IAM & Admin** > **Service Accounts**
4. Click **Create Service Account**
5. Enter a service account name (e.g., `wirespeed-scc-integration`)
6. Enter a description (e.g., `Service account for Wirespeed SCC integration`)
7. Click **Create and Continue**
8. Skip the optional grant project roles step (or skip for now)
9. Click **Done**

### Step 2: Generate and Download the Service Account Key

1. In the Service Accounts list, click on the service account you just created
2. Go to the **Keys** tab
3. Click **Add Key** > **Create new key**
4. Select **JSON** as the key type
5. Click **Create**
6. The JSON key file will download automatically
   * **Keep this file secure** - it contains credentials to access your organization's security data
7. Open the JSON file with a text editor and copy the entire contents

### Step 3: Grant Organization-Level Permissions

1. Navigate to your **Organization** level (click the organization name in the top left dropdown)
2. Go to **IAM & Admin** > **IAM**
3. Click **Grant Access**
4. In the **New principals** field, enter the service account email (found in the JSON key as `client_email`)
5. Click the **Select a role** dropdown and search for and select the following roles:
   * **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`)
6. Click **Save**

<Warning>The service account must be granted roles at the **Organization level** (not the project level) to access findings across all projects within your organization.</Warning>

### Step 4: Find Your Organization ID

1. In the Google Cloud Console, go to **IAM & Admin** > **Settings**
2. Find the **Organization ID** field at the top
3. Copy this ID

### Step 5: Configure Wirespeed

1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select **Google Security Center**
3. Enter the following information:
   * **Organization ID**: The organization ID from Step 4
   * **Service Account Key**: The complete JSON contents from Step 2
4. Click **Save**

Wirespeed will begin collecting detections from your Google Cloud Security Command Center.

<Info>On first sync, Wirespeed fetches up to the newest **5,000** findings.</Info>

## Option B: Workload Identity Federation

Use Workload Identity Federation if you want Wirespeed to authenticate without storing a long-lived Google service account key.

This integration supports direct federated access from Wirespeed's AWS role. Do not configure service account impersonation for this integration.

### Step 1: Create a Workload Identity Pool

1. In the Google Cloud Console, go to **IAM & Admin** > **Workload Identity Federation**.
2. Click **Create pool**.
3. Enter a pool name, for example `wirespeed`.
4. Click **Continue**.

### Step 2: Add an AWS Provider

1. Select **AWS** as the provider type.
2. Enter a provider name, for example `wirespeed-aws`.
3. Enter Wirespeed's AWS account ID: `194722417411`
4. Configure the attribute mappings:
   * `google.subject=assertion.arn`
   * `attribute.account=assertion.account`
   * `attribute.aws_role=assertion.arn.extract('assumed-role/{role_name}/')`
5. Configure the attribute condition: `assertion.account=='194722417411'`
6. Save the provider.

### Step 3: Grant Security Command Center Access

1. Navigate to your **Organization** level in the Google Cloud Console.
2. Go to **IAM & Admin** > **IAM**.
3. Click **Grant Access**.
4. In the **New principals** field, enter the principal set for Wirespeed's AWS role:
   * `principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.aws_role/wirespeed-gcp`
5. Replace `PROJECT_NUMBER` with the Google Cloud project number that contains the workload identity pool.
6. Replace `POOL_ID` with the workload identity pool ID, for example `wirespeed`.
7. Select **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`).
8. Click **Save**.

<Warning>This role must be granted at the **Organization level** to access findings across all projects within your organization.</Warning>

### Step 4: Download the Credential Configuration

1. Go back to **IAM & Admin** > **Workload Identity Federation**.
2. Open the workload identity pool and provider you created for Wirespeed.
3. Click **Download config**.
4. Choose the direct federated identity configuration for the AWS provider.
5. Download the Google credential configuration JSON.

<Warning>Do not select service account impersonation. The JSON should have `type: "external_account"` and must not include `service_account_impersonation_url`.</Warning>

### Step 5: Find Your Organization ID

1. In the Google Cloud Console, go to **IAM & Admin** > **Settings**.
2. Find the **Organization ID** field at the top.
3. Copy this ID.

### Step 6: Configure Wirespeed

1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse).
2. Select **Google Security Center**.
3. Select **Workload Identity Federation** as the authentication method.
4. Enter the following information:
   * **Organization ID**: The organization ID from Step 5
   * **Workload identity configuration**: The complete Google credential configuration JSON from Step 4
5. Click **Save**.

Wirespeed will begin collecting detections from your Google Cloud Security Command Center.