An organization needs to configure real-time exporting of Google Cloud Security Command Center (SCC) Premium threat findings to an external SIEM solution operating on-premises. Arrange the steps in the correct operational sequence to implement this security log export architecture.
- 1Enable Security Command Center Premium at the organization level to generate threat detection findings.
- 2Create a Pub/Sub topic and subscription in a dedicated central logging project to serve as the ingestion buffer.
- 3Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic for automated finding streaming.
- 4Deploy a pull subscriber or forwarder service to pull messages from Pub/Sub and stream them securely to the on-premises SIEM.
Answer
The correct operational sequence is: 1) Enable Security Command Center Premium at the organization level. 2) Create a Pub/Sub topic and subscription in a dedicated project. 3) Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic. 4) Deploy a forwarder service to pull messages from Pub/Sub and stream them to the on-premises SIEM.
The sequence follows standard Cloud Architecture dependencies: first enable the finding source (SCC Premium), then establish the transport messaging buffer (Pub/Sub topic), configure the publishing source to stream to that buffer (SCC Continuous Export), and finally implement the consumer process that delivers findings to the external SIEM.
Step-by-Step Solution
Key Concept
Security Command Center Continuous Export to Pub/Sub and External SIEM Integration