# Importing ComplyForm Findings into Google Security Command Center (SCC)

## Prerequisites

- Google Cloud project with Security Command Center enabled
- `gcloud` CLI configured with appropriate permissions
- ComplyForm SCC export file (`scc-findings.json`)

## Steps

1. **Register the ComplyForm source** (one-time setup):

   ```bash
   gcloud scc sources create organizations/{{ org_id }} \
     --display-name="ComplyForm" \
     --description="ComplyForm compliance findings"
   ```

2. **Import findings** using the SCC API:

   ```bash
   complyform export scc --file=scc-findings.json
   gcloud scc findings bulk-mute organizations/{{ org_id }} \
     --filter='source_properties.tool="ComplyForm"'
   ```

3. **Verify** in the GCP Console under Security > Security Command Center > Findings.

## Notes

- Findings are mapped to SCC categories based on compliance framework controls.
- Severity levels are translated from ComplyForm risk scores.
- Re-running the import will update existing findings rather than create duplicates.
