.TH "GCLOUD_ALPHA_SCC_ASSETS_GROUP" 1



.SH "NAME"
.HP
gcloud alpha scc assets group \- filter an organization's assets and groups them by their specified properties



.SH "SYNOPSIS"
.HP
\f5gcloud alpha scc assets group\fR [\fIPARENT\fR] [\fB\-\-compare\-duration\fR=\fICOMPARE_DURATION\fR] [\fB\-\-filter\fR=\fIFILTER\fR] [\fB\-\-group\-by\fR=\fIGROUP_BY\fR] [\fB\-\-page\-size\fR=\fIPAGE_SIZE\fR] [\fB\-\-page\-token\fR=\fIPAGE_TOKEN\fR] [\fB\-\-read\-time\fR=\fIREAD_TIME\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(ALPHA)\fR \fB(DEPRECATED)\fR Security Command Center Asset APIs are
deprecated and will be removed on or after June 26, 2024. Use Cloud Asset
Inventory instead (gcloud asset)
(https://cloud.google.com/sdk/gcloud/reference/asset). For more information, see
the deprecation notice at Assets Page
(https://cloud.google.com/security\-command\-center/docs/how\-to\-use\-security\-command\-center#assets_page).


Filter an organization's assets and groups them by their specified properties.



.SH "EXAMPLES"

Group assets under organization 123456 by their type (e.g. project, disk,
compute instance, service etc):

.RS 2m
$ gcloud alpha scc assets group 123456 \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets under project example\-project by their type (e.g. project, disk,
compute instance, service etc):

.RS 2m
$ gcloud alpha scc assets group projects/example\-project \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets under folder 456 by their type (e.g. project, disk, compute
instance, service etc):

.RS 2m
$ gcloud alpha scc assets group folders/456 \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group compute instances (assets) under organization 123456 by their respective
projects:

.RS 2m
$ gcloud alpha scc assets group 123456 \e
    \-\-filter="security_center_properties.resource_type=\e"google.comp\e
ute.Instance\e"" \e
\-\-group\-by="security_center_properties.resource_project"
.RE

Group assets that were updated on or after 2019\-01\-01T01:00:00 GMT by their
types.

.RS 2m
$ gcloud alpha scc assets group 123456 \e
    \-\-filter="update_time >= 1546304400000" \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets into following 3 state_changes (ADDED/DELETED/ACTIVE) based on the
activity during past 24 hours:

.RS 2m
$ gcloud alpha scc assets group 123456 \-\-compare\-duration=86400s \e
    \-\-group\-by="state_change"
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Parent resource \- parent organization, folder, or project in the Google Cloud
resource hierarchy to be used for the \f5gcloud scc\fR command. Specify the
argument as either [RESOURCE_TYPE/RESOURCE_ID] or [RESOURCE_ID], as shown in the
preceding examples. This represents a Cloud resource.


.RS 2m
.TP 2m
[\fIPARENT\fR]

ID of the parent or fully qualified identifier for the parent.

To set the \f5parent\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5parent\fR on the command line;
.IP "\(bu" 2m
Set the parent property in configuration using \f5gcloud config set
scc/parent\fR if it is not specified in command line.
.RE
.sp


.RE
.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-compare\-duration\fR=\fICOMPARE_DURATION\fR

The result's "state_change" attribute is updated to indicate whether the asset
was added, removed, or remained present during the compare_duration period of
time that precedes the read_time. See \f5$ gcloud topic datetimes\fR for
information on supported duration formats.

.TP 2m
\fB\-\-filter\fR=\fIFILTER\fR

Expression is a list of one or more restrictions combined via logical operators
\'AND' and 'OR'. Parentheses are not supported, and 'OR' has higher precedence
than 'AND'. For example, 'update_time > 100 AND
security_center_properties.resource_type=\e"google.cloud.resourcemanager.Organization\e"'
is a valid filter string.

.TP 2m
\fB\-\-group\-by\fR=\fIGROUP_BY\fR

Expression that defines what asset fields to use for grouping (including
\'state'). String value should follow SQL syntax: comma separated list of
fields. For example: "parent,resource_name". The following fields are supported:
.RS 2m
.IP "\(em" 2m
security_center_properties.resource_project
.IP "\(em" 2m
security_center_properties.resource_type
.IP "\(em" 2m
security_center_properties.resource_parent
.IP "\(em" 2m
state_change
.RE
.sp

.TP 2m
\fB\-\-page\-size\fR=\fIPAGE_SIZE\fR

The maximum number of results to return in a single response. Default is 10,
minimum is 1, maximum is 1000.

.TP 2m
\fB\-\-page\-token\fR=\fIPAGE_TOKEN\fR

Value returned by the last 'GroupAssetsResponse'; indicates that this is a
continuation of a prior 'GroupAssets' call, and that the system should return
the next page of data.

.TP 2m
\fB\-\-read\-time\fR=\fIREAD_TIME\fR

Time used as a reference point when filtering. Absence of this field will
default to the API's version of NOW. See \f5$ gcloud topic datetimes\fR for
information on supported time formats.


.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBsecuritycenter/v1\fR API. The full documentation for
this API can be found at: https://cloud.google.com/security\-command\-center



.SH "NOTES"

This command is currently in alpha and might change without notice. If this
command fails with API permission errors despite specifying the correct project,
you might be trying to access an API with an invitation\-only early access
allowlist. These variants are also available:

.RS 2m
$ gcloud scc assets group
.RE

.RS 2m
$ gcloud beta scc assets group
.RE