Question

Your security team uses Security Command Center Premium across the organization. During an incident review, an analyst wants to programmatically pull only newly-generated, high-severity ACTIVE findings from the last 24 hours to feed a triage dashboard, while ignoring findings that have already been resolved or muted. Which approach correctly retrieves this filtered set of findings?

Accepted Answer

Use the SCC Findings API (or gcloud scc findings list) with a filter on state="ACTIVE", severity="HIGH", mute!="MUTED", and eventTime within the last 24 hours

Answer

Enable Cloud Audit Logs Data Access for the Security Command Center API and query Cloud Logging for admin activity entries

Answer

Create a log-based metric that counts SCC findings and configure an alerting policy that fires when the count exceeds a threshold

Answer

Export all findings continuously to BigQuery and rely on the default schema's is_resolved boolean column to exclude closed items