Question

A security operations team ingests findings from both Security Command Center (SCC) Premium and Google SecOps into a single case management workflow. Analysts complain that the same GCP VM compromise generates one SCC finding (from a built-in detector) and one SecOps detection (from a YARA-L rule that consumes SCC findings forwarded into SecOps), producing duplicate cases. Leadership wants to preserve both tools but eliminate the duplicate case creation while keeping SecOps as the correlation and investigation hub. What is the most appropriate architectural adjustment?

Accepted Answer

Continue forwarding SCC findings into SecOps but route case creation only through SecOps, using deduplication/grouping on the asset and finding source so the raw SCC finding enriches rather than opens a separate case.

Answer

Disable SCC's built-in detectors so only the SecOps YARA-L rule fires, removing the duplicate source.

Answer

Stop forwarding SCC findings into SecOps and have analysts pivot to the SCC console manually when a SecOps alert references a GCP asset.

Answer

Configure both SCC and SecOps to independently create cases and add a manual analyst step to close whichever duplicate is opened second.