Question

Your security operations team uses Security Command Center Premium to detect findings across the organization. Leadership wants every new HIGH or CRITICAL finding to automatically create a ticket in an external ITSM system (running on-premises) so analysts can track remediation SLAs. The solution must be event-driven with minimal latency and require no polling. What should you configure?

Accepted Answer

Create a Security Command Center notification config that publishes findings to a Pub/Sub topic, then subscribe a Cloud Function that filters by severity and calls the ITSM system's API to create tickets.

Answer

Schedule a Cloud Scheduler job to query the Security Command Center API hourly with a severity filter and post results to the ITSM system.

Answer

Export all findings continuously to BigQuery and configure the ITSM system to run scheduled queries against the dataset to detect new HIGH and CRITICAL findings.

Answer

Enable Event Threat Detection and configure a log-based metric alert in Cloud Monitoring that emails the ITSM intake address whenever a finding is written.