GCP project ID.

Service account client e-mail.

Service account private key ID.

Service account private key data.

The update interval for the GCP Cost Authorization item, which also equals to the access token regeneration request frequency.

The GCP Access Token is available for 1 hour (3600 seconds) after the generation request.

The period without data after which the "No security data received" trigger fires.

Items are collected when the authorization token is refreshed, and an unchanged value is stored only once per heartbeat hour, so the gap between two stored values reaches {$GCP.AUTH.FREQUENCY} plus one hour. Keep this macro above that sum or the trigger will fire between two collections.

The period (in minutes) of Admin Activity audit log history examined on every collection.

Keep it longer than {$GCP.AUTH.FREQUENCY} so that no event falls between two collections.

Filter to include audit log events by the principal that performed them.

The pattern is read by a JavaScript preprocessing step, so a backslash cannot be used: write a character class such as [.] instead of an escape such as . A pattern containing an unsupported character is ignored, and every principal is then included.

Filter to exclude audit log events by the principal that performed them.

The pattern is read by a JavaScript preprocessing step, so a backslash cannot be used: write a character class such as [.] instead of an escape such as . A pattern containing an unsupported character is ignored, and no principal is then excluded.

Regex matching the role names considered privileged when an IAM binding is added.

The pattern is read by a JavaScript preprocessing step, so a backslash cannot be used: write a character class such as [.] instead of an escape such as . A pattern containing an unsupported character falls back to the default.

Set to 1 to consider only self-managed certificates when reporting the closest expiry.

The number of seconds a master item may spend starting new API requests.

JavaScript preprocessing has a 10 second execution limit, and a request already in flight cannot be

shortened from the script, so this must stay below that limit by at least the Zabbix server Timeout

parameter. With the default server Timeout of 3 seconds, 7 is the highest safe value.

The maximum number of API result pages retrieved per request.

Raising it collects more data per item, but every collection has a fixed time budget: once the budget runs out, paging stops and the affected item reports the truncation in its errors item.

The period the key age trigger looks back over.

On a project with more than {$GCP.SECURITY.SA.MAX} service accounts the accounts are checked in rotating slices,

so a stale key is seen in only one slice per cycle. This must be long enough to cover a full rotation.

The maximum number of service accounts checked for user-managed key age.

Checking a service account costs one request, so a project with many of them can exhaust the collection time budget; the remaining accounts are then reported in the errors item instead of being checked.

The age at which a user-managed service account key is considered stale.

Warning threshold for the time left before the closest SSL certificate expiry.

Critical threshold for the time left before the closest SSL certificate expiry.

The number of distinct source addresses expected to perform administrative changes.

The number of firewall rule changes tolerated during one collection window.

The number of IAM policy changes tolerated during one collection window.

The period after which a still-active security finding is considered to be going unremediated.

The number of impersonated (delegated) configuration changes tolerated during one collection window.

The number of active high severity Security Command Center findings tolerated.

The number of active medium severity Security Command Center findings tolerated.

The number of failing compliance controls tolerated.

Response timeout for API.

Sets HTTP proxy value. If this macro is empty, then no proxy is used.

TLS certificate verification for script items and JavaScript preprocessing: "none" - disabled, "peer" - verify the certificate chain and expiration, "full" - full verification. Any other value enables full verification. To override the setting for this template only, define the macro with the context "GCP Security", e.g. {$HTTP.TLS.VERIFY:"GCP Security"}.

Google Cloud Platform REST authorization with service account authentication parameters and temporary-generated RSA-based JWT-token usage.

The necessary scopes are pre-defined.

Returns a signed authorization token with 1 hour lifetime; it is required only once, and is used for all the dependent script items.

Check the template documentation for the details.

A list of errors from authorization requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

Collects the Admin Activity audit log for the period defined in {$GCP.SECURITY.AUDIT.WINDOW}.

Every entry in the Admin Activity log is a configuration change, so the whole log is collected and classified.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Cloud Logging collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Cloud Logging API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The total number of configuration changes recorded in the Admin Activity audit log during the collection window.

Preprocessing

• JSON Path: $.events_total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of audit log pages retrieved during the last collection.

Preprocessing

• JSON Path: $.pages

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of SetIamPolicy calls (IAM permission grants and revocations).

Preprocessing

• JSON Path: $.iam_changes

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of IAM bindings added for a role matching {$GCP.SECURITY.PRIVILEGED.ROLE.MATCHES} during the collection window.

A principal granted such a role can usually escalate its own permissions further.

Only Resource Manager reports the binding delta in the audit log, so this covers grants made on the project itself, not those made on an individual resource.

Preprocessing

• JSON Path: $.privileged_grants

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of service accounts created during the collection window.

Preprocessing

• JSON Path: $.sa_created

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of service accounts deleted during the collection window.

Preprocessing

• JSON Path: $.sa_deleted

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of user-managed service account keys created during the collection window.

Preprocessing

• JSON Path: $.sa_keys_created

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of firewall rule changes during the collection window.

Preprocessing

• JSON Path: $.firewall_changes

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of organization policy changes during the collection window.

Preprocessing

• JSON Path: $.orgpolicy_changes

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct source addresses that performed configuration changes during the collection window.

Preprocessing

• JSON Path: $.caller_ips

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct principals that performed configuration changes during the collection window.

Preprocessing

• JSON Path: $.principals_active

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct Google Cloud services whose configuration changed during the collection window.

Preprocessing

• JSON Path: $.services_touched

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct resources that changed during the collection window, as opposed to the number of API calls.

Preprocessing

• JSON Path: $.resources_modified

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of operations that exercised an ADMIN_WRITE permission during the collection window.

An operation is counted once however many permissions it checked, so this never exceeds the number of events.

Preprocessing

• JSON Path: $.admin_writes

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of configuration changes that failed during the collection window, including permission denials,

quota exhaustion, and precondition failures.

Preprocessing

• JSON Path: $.failed_ops

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of changes made by one identity impersonating another. Impersonation is legitimate, but it is

also the usual route by which an initial foothold is widened, so a change in the baseline is worth review.

Preprocessing

• JSON Path: $.delegated_calls

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The time elapsed since the most recent configuration change found in the collection window.

No value is reported when the window contains no changes, which is the normal state for a quiet project,

so this item measures recency of activity rather than collection health.

A broken collection is detected by the 'No security data received' trigger on the master item.

Preprocessing

• JSON Path: $.latest_event_time

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The most recent configuration change: when it happened, which method was called, by which principal,

from which address, and on which resource. Collected so that a trigger can be understood without opening the audit log.

Preprocessing

• JSON Path: $.latest_event

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The principals that changed configuration during the collection window.

Collected for the dashboards: the first 10 entries are listed followed by the number omitted, so it is an overview rather than a complete record.

Preprocessing

• JSON Path: $.principals_list

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The source addresses that configuration changes originated from during the collection window.

This is the detail behind the administrative source address trigger.

Collected for the dashboards and for the event name of "Administrative access from more source addresses than expected": the first 10 entries are listed followed by the number omitted, so it is an overview rather than a complete record.

Preprocessing

• JSON Path: $.caller_ips_list

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Collects publicly accessible resources and privileged bindings from Cloud Asset Inventory, and service account key

age from the IAM API. Cloud Asset Inventory is free and covers every service in the project with a single call.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Cloud Asset Inventory and IAM collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Cloud Asset Inventory and IAM API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The number of IAM bindings granted to allUsers or allAuthenticatedUsers anywhere in the project,

such as public storage buckets, public Cloud Run services, or public Pub/Sub topics. Zero is the expected state.

Preprocessing

• JSON Path: $.public_bindings

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of resource policies that grant a role able to rewrite the IAM policy, custom roles included.

A principal holding such a role can grant itself any further permission, so the count is expected to be small and stable.

One policy can name several principals, so this counts the policies rather than the principals; the companion item lists the resources they belong to.

Preprocessing

• JSON Path: $.privileged_bindings

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The total number of resources in the project, collected as context for the other posture metrics.

Preprocessing

• JSON Path: $.assets_total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct resource types in the project, that is, how many Google Cloud services are actually in use.

Preprocessing

• JSON Path: $.assets_types

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct locations the project's resources live in. A change can mean data has moved jurisdiction.

Preprocessing

• JSON Path: $.assets_locations

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of resources carrying no labels, and therefore no recorded owner.

Preprocessing

• JSON Path: $.assets_unlabeled

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of user-managed service account keys across all service accounts in the project.

Google's own system-managed keys are excluded: they rotate automatically and are never actionable.

Preprocessing

• JSON Path: $.sa_keys_usermanaged

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of service accounts in the project, which is the identity surface the key checks cover.

Preprocessing

• JSON Path: $.sa_accounts_total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

How many service accounts were checked for key age on this run.

Below the total, the accounts are checked in rotating slices of {$GCP.SECURITY.SA.MAX}, so every account is

covered within one cycle rather than the accounts past the limit never being checked at all.

Preprocessing

• JSON Path: $.sa_accounts_checked

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The age of the oldest user-managed service account key in the project. Reports zero when no user-managed key exists.

Preprocessing

• JSON Path: $.sa_keys_max_age

  ⛔️Custom on fail: Discard value

The resources that are readable by anyone on the internet.

This is the detail behind the publicly accessible resources trigger.

Collected for the dashboards and for the event name of "Publicly accessible resources detected": the first 10 entries are listed followed by the number omitted, so it is an overview rather than a complete record.

Preprocessing

• JSON Path: $.public_bindings_list

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The resources on which a principal holds a role able to rewrite the IAM policy.

Collected for the dashboards: the first 10 entries are listed followed by the number omitted, so it is an overview rather than a complete record.

Preprocessing

• JSON Path: $.privileged_bindings_list

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The service account that owns the oldest user-managed key in the project.

Preprocessing

• JSON Path: $.sa_keys_oldest_account

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Collects framework compliance summaries and framework deployments from Compliance Manager.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Cloud Security Compliance collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Cloud Security Compliance API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The number of compliance frameworks reporting a compliance summary for this project.

Preprocessing

• JSON Path: $.frameworks

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of compliance frameworks actually deployed on this project.

Collected so that an absent compliance result can be told apart from a compliant one.

Preprocessing

• JSON Path: $.deployments

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of compliance controls currently passing across all deployed frameworks.

Preprocessing

• JSON Path: $.passing_controls

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of compliance controls currently failing across all deployed frameworks.

Preprocessing

• JSON Path: $.failing_controls

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The share of compliance controls currently passing across all deployed frameworks.

Preprocessing

• JSON Path: $.score

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Collects the registered detector list and the active, unmuted findings from Security Command Center.

The two are collected independently so that the detector count is still reported when findings cannot be read.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Security Command Center collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Security Command Center API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The number of Security Command Center detection services registered for this project.

Detectors are tier-dependent, and a findings count of zero is only meaningful while this value is above zero.

Preprocessing

• JSON Path: $.sources

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The total number of active, unmuted Security Command Center findings.

Preprocessing

• JSON Path: $.findings_total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings with CRITICAL severity.

Preprocessing

• JSON Path: $.findings_critical

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings with HIGH severity.

Preprocessing

• JSON Path: $.findings_high

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings with MEDIUM severity.

Preprocessing

• JSON Path: $.findings_medium

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings with LOW severity.

Preprocessing

• JSON Path: $.findings_low

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of distinct finding categories currently active, that is, how many different kinds of problem are reported.

Preprocessing

• JSON Path: $.categories

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings classified as THREAT, meaning a detector believes something is acting

against the project rather than that a setting is wrong. These are incidents, not backlog.

Preprocessing

• JSON Path: $.findings_threat

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings classified as VULNERABILITY, such as an exploitable package or image.

Preprocessing

• JSON Path: $.findings_vulnerability

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of active findings classified as MISCONFIGURATION. Usually the bulk of the backlog.

Preprocessing

• JSON Path: $.findings_misconfiguration

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of findings that have been muted. A muted finding is hidden from the default view, so a

rising count means risk is being suppressed rather than resolved.

Preprocessing

• JSON Path: $.findings_muted

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The time since the oldest still-active finding was first raised. It measures whether findings are being

remediated at all: a value that only ever grows means the backlog is untouched.

Preprocessing

• JSON Path: $.oldest_finding_time

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The most severe active finding, with its category and the resource it was raised on.

Preprocessing

• JSON Path: $.top_finding

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Collects the load balancer SSL certificates of the project and the time left before the closest expiry.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Compute Engine collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Compute Engine API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The number of SSL certificates configured on the load balancers of the project.

Preprocessing

• JSON Path: $.total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The time left before the closest SSL certificate expiry. The value becomes negative once a certificate has expired.

Set {$GCP.SECURITY.CERT.SELF_MANAGED.ONLY} to 1 to ignore Google-managed certificates, which renew themselves.

Preprocessing

• JSON Path: $.expiring_soonest

  ⛔️Custom on fail: Discard value

The number of Google-managed certificates that are not in the ACTIVE state.

Such a certificate serves no traffic, and one that reports PROVISIONING_FAILED_PERMANENTLY never will.

It also carries no expiry date, so it is invisible to the expiry items - which is why it is counted separately.

Preprocessing

• JSON Path: $.unhealthy

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The number of certificates whose expiry date has already passed.

Preprocessing

• JSON Path: $.expired

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The name and type of the certificate that expires soonest.

Preprocessing

• JSON Path: $.expiring_name

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Collects the log entry rate by severity from Cloud Monitoring, as a coarse anomaly counter.

Cloud Monitoring cannot combine series that have different monitored resource types, so the per-severity

totals are summed in the script rather than by the API.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Check for not supported value: any error

  ⛔️Custom on fail: Discard value

Reports a Cloud Monitoring collection that returned only part of its data.

The metrics derived from it are withheld while this is set, so they are absent rather than understated.

Preprocessing

• JSON Path: $.truncated

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

A list of errors from the Cloud Monitoring API requests.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

The rate of log entries written across every severity and resource type in the project.

Preprocessing

• JSON Path: $.rate_total

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The rate of log entries written with ERROR severity or above.

Many projects never emit these severities, in which case the value is legitimately zero.

Preprocessing

• JSON Path: $.rate_error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The rate of log entries written with WARNING severity.

Preprocessing

• JSON Path: $.rate_warning

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The rate of log entries written with NOTICE severity.

Admin Activity audit events are written at this severity, so this tracks the overall rate of configuration change.

Preprocessing

• JSON Path: $.rate_notice

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The rate of log entries written with INFO severity.

Preprocessing

• JSON Path: $.rate_info

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

The service account could not exchange its key for an access token, so no data can be collected from any API.
Check the authorization parameters and GCP API availability from a network segment, where Zabbix-server/proxy is located.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.

No audit log data has been received for longer than {$GCP.SECURITY.NODATA.TIMEOUT}.
The master item keeps no history, so the check runs on this item instead. A value is stored on every change and otherwise once per heartbeat hour, and collection happens whenever the authorization token is refreshed, so this period must stay longer than {$GCP.AUTH.FREQUENCY} plus one hour.

An unusual number of IAM policy changes has been recorded, which can indicate scripted permission rewriting.

An owner, editor, or administrator role binding has been added.
This should not normally happen without human intervention. Confirm from the audit log who was granted which role, and by whom.

Indicates that a service account has been removed.
It is worth confirming the deletion was intended and that no running workload authenticated as it.

A user-managed service account key has been created.
In most environments this is rare enough to confirm every time.

Firewall rules have been changed. Check the audit log for the source ranges and ports of the modified rule.

An organization policy constraint has been changed, which can weaken a guardrail that applies to the entire project.

Configuration changes originated from more distinct source addresses than expected.
Check the audit log for the principal and address of the unexpected activity.

Configuration was changed by an identity acting as another service account.
Confirm the delegation chain is expected: this is the standard mechanism for widening access after a compromise.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.

At least one resource is readable by anyone on the internet.
Search Cloud Asset Inventory for policy:(allUsers OR allAuthenticatedUsers) to find which resource is exposed.

A user-managed service account key has not been rotated within the configured period.
User-managed keys never expire on their own, so they remain valid until they are deleted.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.

No compliance framework is deployed on this project, so the compliance items report nothing rather than reporting compliance.
Deploy the Security Essentials framework, which is available on every Security Command Center service tier.

The project does not satisfy every control of the deployed compliance frameworks.

The number of failing compliance controls has increased.
Useful on projects that tolerate a standing number of failures but still need to know when it grows.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.

Security Command Center has no detection service registered for this project, so no finding can ever be produced.
The findings items are reporting that nothing is looking, not that the project is clean.
Check the Security Command Center service tier and whether it is activated for this project or organization.

The number of active security findings has increased.
This is the most useful findings trigger on a project that carries a standing backlog, since the absolute count alone never returns to zero.

• GCP Security: No security detectors registered

Security Command Center reports at least one critical severity finding for this project.

• GCP Security: No security detectors registered

Security Command Center reports high severity findings for this project.
Raise {$GCP.SECURITY.SCC.HIGH.MAX} on projects with a known backlog and rely on the increase trigger instead.

• GCP Security: No security detectors registered

Security Command Center reports more medium severity findings than the configured threshold.

• GCP Security: No security detectors registered

Security Command Center reports a finding classified as THREAT: an actor or process is acting against this project.
Unlike a misconfiguration, this describes something happening now. Check the finding category and the affected resource first.

A finding has stayed active longer than the configured period, which indicates the backlog is not being worked.
Check the 'Findings: Most severe' item, or Security Command Center, to see which findings are outstanding.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.

An SSL certificate on a load balancer of this project is approaching expiry. Renew or replace it before traffic starts failing.

• GCP Security: Certificate expires imminently

An SSL certificate on a load balancer of this project is about to expire. Traffic to the affected front end will fail once it does.

A managed certificate is not in the ACTIVE state and is therefore serving no traffic.
Check the certificate list in the Google Cloud console for the affected certificate and its provisioning status.
PROVISIONING_FAILED_PERMANENTLY does not recover on its own: the certificate has to be recreated,
usually after correcting the domain's DNS records.

A collection reached a limit of this template and returned only part of its data, so the metrics derived from it were not published.
This is a capacity limit rather than an API failure. Raise the relevant macro ({$GCP.SECURITY.PAGES.MAX} or {$GCP.SECURITY.SA.MAX}),
or narrow what is collected, for example by shortening {$GCP.SECURITY.AUDIT.WINDOW}.

There are errors in response to GCP API requests.
Check the item value for the failing endpoint, and the service account roles and enabled APIs for that service.