Question

Your security operations team uses Security Command Center Premium with Event Threat Detection enabled across the organization. A legacy batch-processing service account regularly triggers 'Persistence: IAM Anomalous Grant' and 'Evasion: Access from Anonymizing Proxy' findings that have been reviewed and confirmed as expected behavior for this specific workload. Analysts are spending significant time re-triaging these recurring findings, but leadership requires that the underlying detections stay active for all other identities and that any future changes to this workload's behavior still generate reviewable records. What should you do?

Accepted Answer

Create a mute rule in Security Command Center that matches the specific finding attributes (category and the batch service account), so matching findings are automatically muted while still being generated and recorded.

Answer

Disable the Event Threat Detection modules for 'Persistence: IAM Anomalous Grant' and 'Access from Anonymizing Proxy' at the organization level to stop the findings.

Answer

Add an IAM deny policy to the batch service account so Security Command Center no longer evaluates its activity.

Answer

Export the findings to BigQuery with a scheduled query that deletes rows matching the batch service account before analysts review them.