gcp-scc-mute-config-create

id: gcp-scc-mute-config-create
emits: CanModifyConfiguration
description: Principal with securitycenter.muteconfigs.create or .update can create or modify a mute config
  that auto-suppresses matching SCC findings, silencing targeted detection signals while SCC appears operational.
match:
- - principal: null
  - HasPermission
  - scc: null
where:
- node_type(?scc) == SecurityService
- ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings']
- ?principal has EFFECTIVE securitycenter.muteconfigs.create OR securitycenter.muteconfigs.update at the
  scope of ?scc
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?scc
  permissions:
  - securitycenter.muteconfigs.create
  - securitycenter.muteconfigs.update
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when ?principal holds effective securitycenter.muteconfigs.create or securitycenter.muteconfigs.update
    at ?scc.scope AND SCC Premium tier is enabled at ?scc.scope. The mute config does not need to pre-exist
    for a .create operation. CONDITIONAL(service_state) if the org or project is on Standard tier (mute
    configs are unavailable in Standard tier; the permission has no effect). BLOCKED if an IAM deny policy
    or VPC-SC perimeter explicitly denies both create and update at the effective scope.
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, securitycenter.muteconfigs.create|securitycenter.muteconfigs.update, ?scc)
  false_positive_note: "Mute configs suppress findings matching their CEL filter expression; they do NOT\
    \ stop the SCC service from generating findings or disable any detection service. The narrative must\
    \ NOT claim \"SCC is disabled\" \u2014 it is \"matching findings are auto-muted.\" SCC remains enabled\
    \ and its dashboard shows findings in other categories. This is stealthier than gcp-scc-disable-service\
    \ because SCC appears fully operational to casual inspection. securitycenter.muteconfigs.create is\
    \ required for new mute configs; .update is required to modify an existing one \u2014 both permissions\
    \ grant the evasion capability (use OR logic). This is DEFENSE EVASION only; do NOT chain to any access/escalation\
    \ edge. Mute config scope: org-scoped configs suppress findings org-wide; project-scoped configs suppress\
    \ only that project's findings. Emit for the SCC node at the scope the permission actually resolves\
    \ at. IMPORTANT: SCC Premium tier is required for mute configs. If the organization or project is\
    \ on Standard tier, the API will reject create/update attempts. Analysts should verify SCC tier to\
    \ distinguish real mute-config capability (Premium) from false positives (Standard tier with permission)."
  narrative: "{principal.name} holds securitycenter.muteconfigs.create or .update at {scc.scope} and can\
    \ create a mute configuration with a CEL filter that auto-suppresses all matching SCC findings (e.g.,\
    \ category=\"ACCOUNT_COMPROMISED\" or targeting specific resource types). The SCC service continues\
    \ operating and appears healthy \u2014 targeted finding categories are silently muted before analysts\
    \ see them. This capability requires SCC Premium tier; Standard tier orgs cannot create mute configs.\
    \ This is a stealthy cover-tracks primitive analogous to a GuardDuty auto-archive filter."