sample_finding.json

{
    "notificationConfigName":"organizations/723388619511/notificationConfigs/scc-findings-export",
    "finding":{
       "name":"organizations/723388619511/sources/15544972255997536156/findings/4305a048229e754b533ece8b60ee6e02",
       "parent":"organizations/723388619511/sources/15544972255997536156",
       "resourceName":"//cloudresourcemanager.googleapis.com/projects/940165680117",
       "state":"ACTIVE",
       "category":"NON_ORG_IAM_MEMBER",
       "externalUri":"https://console.cloud.google.com/iam-admin/iam?project=scc-tf7",
       "sourceProperties":{
          "Recommendation":"Go to https://console.cloud.google.com/iam-admin/iam?project=scc-tf7 and remove entries for users which are not in your organization (e.g. gmail.com addresses). Invalid accounts: [user:amiacs@gmail.com]",
          "ExceptionInstructions":"Add the security mark \"allow_non_org_iam_member\" to the asset with a value of \"true\" to prevent this finding from being activated again.",
          "Explanation":"A user outside of your organization has IAM permissions on a project, folder, or organization.",
          "ScannerName":"IAM_SCANNER",
          "ResourcePath":[
             "projects/scc-tf7/",
             "organizations/723388619511/"
          ],
          "cli_remediation":[
             "gcloud projects remove-iam-policy-binding scc-tf7 --member=user:amiacs@gmail.com --role=roles/editor"
          ],
          "OffendingIamRoles":"{\"invalidRoles\":[{\"user\":\"user:amiacs@gmail.com\",\"roles\":[\"roles/editor\"]}]}",
          "OffendingIamRolesList":[
             {
                "member":"user:amiacs@gmail.com",
                "roles":[
                   "roles/editor"
                ]
             }
          ],
          "compliance_standards":{
             "iso":[
                {
                   "ids":[
                      "A.9.2.3"
                   ]
                }
             ],
             "pci":[
                {
                   "ids":[
                      "7.1.2"
                   ]
                }
             ],
             "cis":[
                {
                   "version":"1.0",
                   "ids":[
                      "1.1"
                   ]
                },
                {
                   "version":"1.1",
                   "ids":[
                      "1.1"
                   ]
                },
                {
                   "version":"1.2",
                   "ids":[
                      "1.1"
                   ]
                },
                {
                   "version":"1.3",
                   "ids":[
                      "1.1"
                   ]
                }
             ],
             "nist":[
                {
                   "ids":[
                      "AC-3"
                   ]
                }
             ]
          },
          "ReactivationCount":12.0
       },
       "securityMarks":{
          "name":"organizations/723388619511/sources/15544972255997536156/findings/4305a048229e754b533ece8b60ee6e02/securityMarks"
       },
       "eventTime":"2023-06-15T23:06:30.261206Z",
       "createTime":"2023-06-15T21:13:11.734Z",
       "severity":"HIGH",
       "canonicalName":"projects/940165680117/sources/15544972255997536156/findings/4305a048229e754b533ece8b60ee6e02",
       "mute":"UNDEFINED",
       "findingClass":"MISCONFIGURATION",
       "compliances":[
          {
             "standard":"cis",
             "version":"1.0",
             "ids":[
                "1.1"
             ]
          },
          {
             "standard":"cis",
             "version":"1.1",
             "ids":[
                "1.1"
             ]
          },
          {
             "standard":"cis",
             "version":"1.2",
             "ids":[
                "1.1"
             ]
          },
          {
             "standard":"cis",
             "version":"1.3",
             "ids":[
                "1.1"
             ]
          },
          {
             "standard":"pci",
             "ids":[
                "7.1.2"
             ]
          },
          {
             "standard":"nist",
             "ids":[
                "AC-3"
             ]
          },
          {
             "standard":"iso",
             "ids":[
                "A.9.2.3"
             ]
          }
       ],
       "parentDisplayName":"Security Health Analytics",
       "description":"A user outside of your organization has IAM permissions on a project, folder, or organization.",
       "iamBindings":[
          {
             "role":"roles/editor",
             "member":"user:amiacs@gmail.com"
          }
       ]
    },
    "resource":{
       "name":"//cloudresourcemanager.googleapis.com/projects/940165680117",
       "project":"//cloudresourcemanager.googleapis.com/projects/940165680117",
       "projectDisplayName":"scc-tf7",
       "parent":"//cloudresourcemanager.googleapis.com/organizations/723388619511",
       "parentDisplayName":"dirtyhash.com",
       "type":"google.cloud.resourcemanager.Project",
       "displayName":"scc-tf7"
    }
 }