Question

Your security operations team wants to trigger an automated remediation workflow whenever Security Command Center generates a new HIGH-severity finding. The workflow is implemented as a Cloud Function that must be invoked in near real time. The team does not want to poll the SCC API on a schedule. What is the recommended way to stream SCC findings to the Cloud Function?

Accepted Answer

Create an SCC notification config with a filter for HIGH-severity findings that publishes to a Pub/Sub topic, and subscribe the Cloud Function to that topic

Answer

Export all SCC findings to a BigQuery dataset and schedule a query every minute that calls the Cloud Function when new HIGH-severity rows appear

Answer

Configure a Cloud Logging sink for SCC findings that writes to Cloud Storage and use an object-finalize trigger on the Cloud Function

Answer

Enable Event Threat Detection and set the Cloud Function as the detector's direct output destination for HIGH-severity events