Question

Your security operations team wants to detect brute-force SSH login attempts against Compute Engine VMs across the organization. They need a repeatable, low-maintenance detection that produces findings in a central console alongside other threat findings, without deploying custom log parsing infrastructure. Which approach should you recommend?

Accepted Answer

Enable Event Threat Detection in Security Command Center Premium, which analyzes Cloud Logging data and surfaces brute-force SSH findings in the SCC dashboard.

Answer

Create a log-based metric on syslog auth failures in each project and configure a Cloud Monitoring alerting policy per VM.

Answer

Export all VM serial console logs to BigQuery and run scheduled queries to count failed login patterns.

Answer

Deploy the Ops Agent on every VM and write a custom Cloud Function to scan streamed auth logs for repeated failures.