[MUSIC PLAYING]
SPEAKER: Mute Findings is a powerful volume management tool
within Security Command Center.
It allows you to automatically silence
findings based on criteria you specify,
or manually silence individual findings.
This feature is relevant for many potential use cases.
For example, assets within non-production environments
where some stricter requirements may not be applicable,
recommendations to use customer-managed encryption
keys in projects that don't contain critical data,
when granting broad access on a datastore which intentionally
is open to the public and disseminates
public information, or for findings
not relevant to your organization
based on your company's policies.
Muted findings don't appear by default in the Security Command
Center dashboard.
However, they continue to be logged
and can be accessed as needed.
There are two ways you can mute findings.
You can create mute rules that automatically mute findings
as they are generated, or you can choose to mute and unmute
individual findings.
Let's see this feature in action.
Currently we are located at the Security Command Center
Findings tab for a specific project.
We'll focus on a category of findings
that are generated when bucket logging is disabled.
Suppose we want to silence findings within this category.
We can use the Mute Findings feature to hide them.
As you can see, we can select individual findings
to mute and unmute using the Mute Options menu,
but you can also create a mute rule
to automatically mute findings as they are
generated based on a criteria.
First we'll give the mute rule an ID.
Note that this rule will apply to all findings generated
within the resource that we have selected.
Now we'll set up the filter by selecting
Category equal to Bucket Logging Disabled.
After clicking Apply, we can preview any existing findings
that match this filter.
Once this rule is implemented, all existing and new findings
that exactly match the filter will be hidden,
and the mute attribute for the findings will be set to Muted.
One thing to note-- if you are creating
mute rules with the gcloud tool or Security Command Center API,
muting existing and future findings
are two separate operations, so be sure to check out
the documentation for details.
After clicking Save, we'll return to the Security Command
Center and review our findings.
Our new mute rule has taken effect,
and we can no longer see any findings in the Bucket Logging
Disabled category.
As mentioned, mute rules created in the Console
will mute both existing and future findings
that match the filter.
So let's create another bucket to see how
future findings are handled.
We're back.
After creating a new bucket, we can
see that no additional findings in the Bucket Logging
Disabled category are visible.
However, findings that are muted are not deleted,
and new findings that match mute rules continue to be logged.
As such, they can be viewed by selecting More Options
and choosing Include Muted Findings.
Now we can see the muted findings, including
the additional finding that was just
created for our new bucket.
The Include Muted Findings option
is useful when you are trying to review
all findings for any audit or compliance needs.
Now if we would like to review only the muted findings,
we can apply a filter--
Mute equals Muted.
In these muted findings, we can see when a finding was muted
and who muted the finding, which we can use for audit purposes
at any time.
We can also configure any notifications
that we've set up to exclude updates
from any new or existing findings that are muted.
Mute rules can be managed from the Mute Settings page.
On this page, we can view our rules,
edit them, and delete them.
When we delete a rule, it doesn't
unmute any findings that were muted
in the past as a result of this rule,
but future findings will no longer be muted.
Congratulations.
You're now equipped to use the Mute Findings
feature in Security Command Center as a customizable volume
management tool.
[MUSIC PLAYING]