Question

Your security operations team uses Security Command Center Premium across the organization. They are overwhelmed by the volume of findings flowing into their notification pipeline. Leadership wants an automated stream that alerts the on-call engineer only for actively exploitable HIGH and CRITICAL findings from Event Threat Detection, delivered in near real time to a downstream automation system. What should you configure?

Accepted Answer

Create a Security Command Center notification config that publishes to a Pub/Sub topic, using a filter on category source, severity in (HIGH, CRITICAL), and state = ACTIVE.

Answer

Create an aggregated Cloud Logging sink that exports all SCC findings to BigQuery, then schedule a query to email the on-call engineer nightly.

Answer

Enable Continuous Exports to a Jira project and configure Jira automation rules to page the on-call engineer for HIGH and CRITICAL issues.

Answer

Apply Security Marks to all HIGH and CRITICAL findings and rely on the SCC dashboard's default mute rules to surface only relevant items.