Question

A security operations team wants Security Command Center (SCC) Premium findings—such as vulnerabilities and misconfigurations—to flow automatically into Google SecOps so analysts can correlate them with UDM events and threat intel. The lead engineer must configure the integration so findings are ingested continuously without granting excessive permissions to the export mechanism. Which approach correctly enables this integration while following least-privilege principles?

Accepted Answer

Configure an SCC continuous export to a Pub/Sub topic, then set up a SecOps Pub/Sub ingestion feed using a service account granted only the roles needed to subscribe to that topic.

Answer

Grant the SecOps service account the Organization Owner role so it can directly query all SCC findings through the SCC API on demand.

Answer

Manually export SCC findings to a CSV each day and upload them through the SecOps UI, assigning analysts the SCC Admin role for the export.

Answer

Enable Cloud IDS logging and rely on it to forward SCC findings to SecOps, since both are network-layer telemetry sources.