.TH "GCLOUD_SCC_ASSETS_GROUP" 1



.SH "NAME"
.HP
gcloud scc assets group \- filter an organization's assets and groups them by their specified properties



.SH "SYNOPSIS"
.HP
\f5gcloud scc assets group\fR [\fIPARENT\fR] [\fB\-\-compare\-duration\fR=\fICOMPARE_DURATION\fR] [\fB\-\-filter\fR=\fIFILTER\fR] [\fB\-\-group\-by\fR=\fIGROUP_BY\fR] [\fB\-\-page\-size\fR=\fIPAGE_SIZE\fR] [\fB\-\-page\-token\fR=\fIPAGE_TOKEN\fR] [\fB\-\-read\-time\fR=\fIREAD_TIME\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(DEPRECATED)\fR Security Command Center Asset APIs are deprecated and will be
removed on or after June 26, 2024. Use Cloud Asset Inventory instead (gcloud
asset) (https://cloud.google.com/sdk/gcloud/reference/asset). For more
information, see the deprecation notice at Assets Page
(https://cloud.google.com/security\-command\-center/docs/how\-to\-use\-security\-command\-center#assets_page).


Filter an organization's assets and groups them by their specified properties.



.SH "EXAMPLES"

Group assets under organization 123456 by their type (e.g. project, disk,
compute instance, service etc):

.RS 2m
$ gcloud scc assets group 123456 \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets under project example\-project by their type (e.g. project, disk,
compute instance, service etc):

.RS 2m
$ gcloud scc assets group projects/example\-project \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets under folder 456 by their type (e.g. project, disk, compute
instance, service etc):

.RS 2m
$ gcloud scc assets group folders/456 \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group compute instances (assets) under organization 123456 by their respective
projects:

.RS 2m
$ gcloud scc assets group 123456 \e
    \-\-filter="security_center_properties.resource_type=\e"google.comp\e
ute.Instance\e"" \e
\-\-group\-by="security_center_properties.resource_project"
.RE

Group assets that were updated on or after 2019\-01\-01T01:00:00 GMT by their
types.

.RS 2m
$ gcloud scc assets group 123456 \e
    \-\-filter="update_time >= 1546304400000" \e
    \-\-group\-by="security_center_properties.resource_type"
.RE

Group assets into following 3 state_changes (ADDED/DELETED/ACTIVE) based on the
activity during past 24 hours:

.RS 2m
$ gcloud scc assets group 123456 \-\-compare\-duration=86400s \e
    \-\-group\-by="state_change"
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Parent resource \- parent organization, folder, or project in the Google Cloud
resource hierarchy to be used for the \f5gcloud scc\fR command. Specify the
argument as either [RESOURCE_TYPE/RESOURCE_ID] or [RESOURCE_ID], as shown in the
preceding examples. This represents a Cloud resource.


.RS 2m
.TP 2m
[\fIPARENT\fR]

ID of the parent or fully qualified identifier for the parent.

To set the \f5parent\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5parent\fR on the command line;
.IP "\(bu" 2m
Set the parent property in configuration using \f5gcloud config set
scc/parent\fR if it is not specified in command line.
.RE
.sp


.RE
.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-compare\-duration\fR=\fICOMPARE_DURATION\fR

The result's "state_change" attribute is updated to indicate whether the asset
was added, removed, or remained present during the compare_duration period of
time that precedes the read_time. See \f5$ gcloud topic datetimes\fR for
information on supported duration formats.

.TP 2m
\fB\-\-filter\fR=\fIFILTER\fR

Expression is a list of one or more restrictions combined via logical operators
\'AND' and 'OR'. Parentheses are not supported, and 'OR' has higher precedence
than 'AND'. For example, 'update_time > 100 AND
security_center_properties.resource_type=\e"google.cloud.resourcemanager.Organization\e"'
is a valid filter string.

.TP 2m
\fB\-\-group\-by\fR=\fIGROUP_BY\fR

Expression that defines what asset fields to use for grouping (including
\'state'). String value should follow SQL syntax: comma separated list of
fields. For example: "parent,resource_name". The following fields are supported:
.RS 2m
.IP "\(em" 2m
security_center_properties.resource_project
.IP "\(em" 2m
security_center_properties.resource_type
.IP "\(em" 2m
security_center_properties.resource_parent
.IP "\(em" 2m
state_change
.RE
.sp

.TP 2m
\fB\-\-page\-size\fR=\fIPAGE_SIZE\fR

The maximum number of results to return in a single response. Default is 10,
minimum is 1, maximum is 1000.

.TP 2m
\fB\-\-page\-token\fR=\fIPAGE_TOKEN\fR

Value returned by the last 'GroupAssetsResponse'; indicates that this is a
continuation of a prior 'GroupAssets' call, and that the system should return
the next page of data.

.TP 2m
\fB\-\-read\-time\fR=\fIREAD_TIME\fR

Time used as a reference point when filtering. Absence of this field will
default to the API's version of NOW. See \f5$ gcloud topic datetimes\fR for
information on supported time formats.


.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBsecuritycenter/v1\fR API. The full documentation for
this API can be found at: https://cloud.google.com/security\-command\-center



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha scc assets group
.RE

.RS 2m
$ gcloud beta scc assets group
.RE