.TH "GCLOUD_ALPHA_SCC_FINDINGS_UPDATE" 1



.SH "NAME"
.HP
gcloud alpha scc findings update \- update a Security Command Center finding



.SH "SYNOPSIS"
.HP
\f5gcloud alpha scc findings update\fR \fIFINDING\fR [\fB\-\-event\-time\fR=\fIEVENT_TIME\fR] [\fB\-\-external\-uri\fR=\fIEXTERNAL_URI\fR] [\fB\-\-location\fR=\fILOCATION\fR;\ default="global"] [\fB\-\-source\fR=\fISOURCE\fR;\ default="\-"] [\fB\-\-source\-properties\fR=[\fIKEY\fR=\fIVALUE\fR,...]] [\fB\-\-state\fR=\fISTATE\fR] [\fB\-\-update\-mask\fR=\fIUPDATE_MASK\fR] [\fB\-\-folder\fR=\fIFOLDER\fR\ |\ \fB\-\-organization\fR=\fIORGANIZATION\fR\ |\ \fB\-\-project\fR=\fIPROJECT\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(ALPHA)\fR Update a Security Command Center finding.



.SH "EXAMPLES"

Update testFinding's state from \f5ACTIVE\fR to \f5INACTIVE\fR:

.RS 2m
$ gcloud alpha scc findings update `testFinding` \e
    \-\-organization=123456 \-\-source=5678 \-\-state=INACTIVE
.RE

Update testFinding's state from \f5ACTIVE\fR to \f5INACTIVE\fR using project
name for example\-project:

.RS 2m
$ gcloud alpha scc findings update \e
    projects/example\-project/sources/5678/findings/testFinding \e
    \-\-state=INACTIVE
.RE

Update testFinding's state from \f5ACTIVE\fR to \f5INACTIVE\fR using folder name
\f5456\fR:

.RS 2m
$ gcloud alpha scc findings update \e
    folders/456/sources/5678/findings/testFinding \-\-state=INACTIVE
.RE

Override all source properties on \f5testFinding\fR:

.RS 2m
$ gcloud alpha scc findings update `testFinding` \e
    \-\-organization=123456 \-\-source=5678 \e
    \-\-source\-properties="propKey1=propVal1,propKey2=propVal2"
.RE

Selectively update a specific source property on \f5testFinding\fR:

.RS 2m
$ gcloud alpha scc findings update `testFinding` \e
    \-\-organization=123456 \-\-source=5678 \e
    \-\-source\-properties="propKey1=propVal1,propKey2=propVal2" \e
    \-\-update\-mask="source_properties.propKey1"
.RE

Update finding \f5testFinding\fR with \f5location=eu\fR, state from \f5ACTIVE\fR
to \f5INACTIVE\fR:

.RS 2m
$ gcloud alpha scc findings update `testFinding` \e
    \-\-organization=123456 \-\-source=5678 \-\-state=INACTIVE \e
    \-\-location=eu
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m
\fIFINDING\fR

ID of the finding or fully qualified identifier for the finding.


.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-event\-time\fR=\fIEVENT_TIME\fR

Time at which the event took place. For example, if the finding represents an
open firewall it would capture the time the open firewall was detected. If
event\-time is not provided, it will default to UTC version of NOW. See \f5$
gcloud topic datetimes\fR for information on supported time formats.

.TP 2m
\fB\-\-external\-uri\fR=\fIEXTERNAL_URI\fR

URI that, if available, points to a web page outside of Cloud SCC (Security
Command Center) where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.

.TP 2m
\fB\-\-location\fR=\fILOCATION\fR; default="global"

When data residency controls are enabled, this attribute specifies the location
in which the resource is located and applicable. The \f5location\fR attribute
can be provided as part of the fully specified resource name or with the
\f5\-\-location\fR argument on the command line. The default location is
\f5global\fR.

NOTE: If you override the endpoint to a regional endpoint
(https://cloud.google.com/security\-command\-center/docs/reference/rest/index.html?rep_location=global#regional\-service\-endpoint)
you must specify the correct data location
(https://cloud.google.com/security\-command\-center/docs/data\-residency\-support#locations)
using this flag. The default location on this command is unrelated to the
default location that is specified when data residency controls are enabled for
Security Command Center.

NOTE: If no location is specified, the default location is \f5global\fR AND the
request will be routed to the SCC V1 API. To use the SCC V2 API \- please
explicitly specify the flag.

.TP 2m
\fB\-\-source\fR=\fISOURCE\fR; default="\-"

Source id. Defaults to all sources.

.TP 2m
\fB\-\-source\-properties\fR=[\fIKEY\fR=\fIVALUE\fR,...]

Source specific properties. These properties are managed by the source that
writes the finding. The key names in the source_properties map must be between 1
and 255 characters, and must start with a letter and contain alphanumeric
characters or underscores only. For example "key1=val1,key2=val2"

.TP 2m
\fB\-\-state\fR=\fISTATE\fR

State is one of: [ACTIVE, INACTIVE]. \fISTATE\fR must be one of: \fBactive\fR,
\fBinactive\fR, \fBstate\-unspecified\fR.

.TP 2m
\fB\-\-update\-mask\fR=\fIUPDATE_MASK\fR

Optional: If left unspecified (default), an update\-mask is automatically
created using the flags specified in the command and only those values are
updated. For example: \-\-external\-uri='<some\-uri>'
\-\-event\-time='<some\-time>' would automatically generate
\-\-update\-mask='external_uri,event_time'. Note that as a result, only
external\-uri and event\-time are updated for the given finding and everything
else remains untouched. If you want to delete attributes/properties (that are
not being changed in the update command) use an empty update\-mask (''). That
will delete all the mutable properties/attributes that aren't specified as flags
in the update command. In the above example it would delete source\-properties.
State can be toggled from ACTIVE to INACTIVE and vice\-versa but it cannot be
deleted.

.TP 2m

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-folder\fR=\fIFOLDER\fR

The folder ID (e.g., 456) that contains the finding.

.TP 2m
\fB\-\-organization\fR=\fIORGANIZATION\fR

The organization ID (e.g., 123) that contains the finding.

.TP 2m
\fB\-\-project\fR=\fIPROJECT\fR

The project ID (e.g., example\-project) that contains the finding.


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the Security Command Center API. For more information, see
Security Command Center API.
(https://cloud.google.com/security\-command\-center/docs/reference/rest)



.SH "NOTES"

This command is currently in alpha and might change without notice. If this
command fails with API permission errors despite specifying the correct project,
you might be trying to access an API with an invitation\-only early access
allowlist. These variants are also available:

.RS 2m
$ gcloud scc findings update
.RE

.RS 2m
$ gcloud beta scc findings update
.RE