Export Findings to Google Security Command Center

Send Mondoo findings to Google Security Command Center using one-click Workload Identity Federation, manual WIF, or a service account key.

Send your Mondoo findings to Google Security Command Center (SCC) so your Google Cloud security team sees Mondoo results alongside Google's own detections. Unlike the storage and warehouse exports, this integration writes SCC findings rather than files or tables. For how exports work in general, read Continuous Data Exports.

Requirements

A Google Cloud organization with Security Command Center enabled
An SCC source that Mondoo writes findings to. Create one with gcloud scc sources create and note its full resource name, in the format organizations/ORGANIZATION_ID/sources/SOURCE_ID.
Editor or Owner access to the Mondoo space from which you want to export findings
Permission in GCP to create service accounts, Workload Identity Pools, and organization-level IAM policy bindings

Choose an authentication method

Mondoo can authenticate to GCP in three ways:

One-click Workload Identity Federation (WIF) (recommended): Keyless. You give Mondoo your project ID and project number, and Mondoo hands you a ready-to-run gcloud script that creates everything WIF needs. Nothing to rotate, and no values to copy back into Mondoo.
Manual WIF: Also keyless, but you create the Workload Identity Pool, OIDC provider, and service account yourself, then paste the audience URL and service account email into Mondoo.
Service account key: A static JSON key file. Simplest to set up, but you're responsible for securely storing and regularly rotating the key.

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write findings. No static keys are stored or transmitted.

In the one-click flow, Mondoo generates the setup script for you. The script creates these resources in your project:

Resource	Name
Workload Identity Pool	`mondoo-pool`
OIDC provider	`mondoo-provider`
Export service account	`mondoo-export@PROJECT_ID.iam.gserviceaccount.com`

It also grants the export service account the Security Center Findings Editor role (roles/securitycenter.findingsEditor) on the organization, and authorizes the pool to impersonate that service account.

Organization-scoped permission

Google Cloud does not offer a source-scoped IAM binding for findings. The Findings Editor role is granted at the organization level, so the service account can write findings to every SCC source in the organization, not only the one you configure here. This is the narrowest binding Google provides for writing findings.

The script is safe to run more than once. Every resource it creates is idempotent, so if a step fails you can run the whole script again.

Step 1: Find your project ID and project number

Both values appear on your Google Cloud console dashboard. Neither is the project's display name.

The project ID is the unique ID string, for example my-project-123.
The project number is the auto-assigned numeric ID, for example 123456789012.

To retrieve them from the CLI:

gcloud projects describe PROJECT_ID --format='value(projectId,projectNumber)'

Step 2: Create the SCC export integration in Mondoo

In the Mondoo App, navigate to the space from which you want to export findings.
In the side navigation bar, select Integrations. Under Exports, select Google Security Command Center.
In the Choose an integration name box, enter a name for the integration.
In the Source Name box, enter the full SCC source resource name, for example organizations/123456/sources/789.
Under Configure authentication, select the Workload Identity Federation (recommended) tab.
In the Project ID box, enter your project ID. In the Project number box, enter your project number.
Select Generate setup.

Mondoo creates the integration and shows you the setup script. No findings are exported yet.

Step 3: Run the setup script in Google Cloud

Select Open in Google Cloud Shell. Cloud Shell opens in a new tab, scoped to the project you entered.
Copy the script from Mondoo, paste it into Cloud Shell, and press Enter.
Wait for the script to print Mondoo GCP export setup complete. If you don't see that line, the script didn't finish. Run it again.

You can also run the script from any workstation with the GCP CLI (gcloud) installed and authenticated to the target project.

Step 4: Run the first export

Return to the Mondoo tab and select Run first export.

New GCP permissions can take a few minutes to propagate. If the first export fails with a permissions error, wait a moment and try again.

Step 5: Verify the integration

On the integration details page, wait for the export to complete. If the status changes to active, the setup is working correctly.
In the Google Cloud console, open Security Command Center > Findings and filter by your Mondoo source to confirm findings arrived.

If the export fails, double-check:

The setup script finished successfully in the same project whose ID and number you entered in Mondoo.
The source name is the full resource name, including the organizations/ and sources/ segments.
The SCC source exists in the same organization the script granted the Findings Editor role on.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select SCHEDULE NOW.
Check the status. active means the integration is healthy and exporting on schedule. pending means Mondoo hasn't attempted the first export yet. error means the last export failed.
Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.