In modern cloud setups, security alerts often get lost in the noise. With thousands of logs generated daily, it’s hard to catch real threats before they cause harm. That’s why your detection system must be smart enough to sort and escalate alerts based on actual risk. Google Cloud’s Security Command Center helps you do just that. It gives you a full view of risks, misconfigurations, and threats across your environment. In this guide, you’ll learn how to set up a tiered alerting system using SCC, Pub/Sub, Cloud Logging, and Security Health Analytics. This setup helps you act fast and stay aligned with real-time risk. Security Command Center SCC Pub/Sub Cloud Logging Security Health Analytics What is the Security Command Center? In today’s cloud environments, you deal with a constant stream of alerts and logs. But most of it is just noise, making it tough to catch serious threats early. When that happens, critical issues can slip through and create To stay ahead, you need an alert system that filters what matters. Google Cloud’s Security Command Center (SCC) helps you do just that. It connects logging, risk insights, and alert rules to catch high-risk events faster. For instance, it provides; Feature

Description



Security Health Analytics

Detects misconfigurations and compliance risks.



Event Threat Detection

Real-time detection of suspicious activity and threats.



Container Threat Detection

Runtime container protection for GKE workloads.



Attack Path Simulation

(2025 Preview) Predictive modeling of attack paths. Feature

Description



Security Health Analytics

Detects misconfigurations and compliance risks.



Event Threat Detection

Real-time detection of suspicious activity and threats.



Container Threat Detection

Runtime container protection for GKE workloads.



Attack Path Simulation

(2025 Preview) Predictive modeling of attack paths. Feature

Description Feature Feature Feature Description Description Description Security Health Analytics

Detects misconfigurations and compliance risks. Security Health Analytics Security Health Analytics Detects misconfigurations and compliance risks. Detects misconfigurations and compliance risks. Event Threat Detection

Real-time detection of suspicious activity and threats. Event Threat Detection Event Threat Detection Real-time detection of suspicious activity and threats. Real-time detection of suspicious activity and threats. Container Threat Detection

Runtime container protection for GKE workloads. Container Threat Detection Container Threat Detection Runtime container protection for GKE workloads. Runtime container protection for GKE workloads. Attack Path Simulation

(2025 Preview) Predictive modeling of attack paths. Attack Path Simulation Attack Path Simulation (2025 Preview) Predictive modeling of attack paths. (2025 Preview) Predictive modeling of attack paths. Security Command Center works easily with Cloud Logging, Pub Sub, and BigQuery. It also connects with Chronicle and other SIEM tools. This helps you build a simple, tiered alerting setup that supports real-time responses. Why Tiered Alerting? Not every alert deserves the same attention. If everything looks urgent, your team won’t know what needs action. With tiered alerting, you can sort signals by risk: High-risk issues get flagged right away, things like leaked keys or suspicious data use.
Medium alerts are still tracked but don’t need an immediate fix.
Low-priority alerts are logged in the background and handled quietly. They don’t interrupt your team or delay critical work. This keeps your focus on real issues. High-risk issues get flagged right away, things like leaked keys or suspicious data use. Medium alerts are still tracked but don’t need an immediate fix. Low-priority alerts are logged in the background and handled quietly. They don’t interrupt your team or delay critical work. This keeps your focus on real issues. This way, you stay focused on what truly matters and avoid wasting time on false alarms. Tiered Alerting Architecture on GCP You need a clear way to handle cloud security alerts. Tiered alerting on GCP lets you sort alerts by risk level. It uses SCC, Pub/Sub, and Logging to flag real issues. This helps your team react fast and avoid alert fatigue. Step-by-Step Implementation Here are the steps to build a tiered alerting system on GCP. These steps help you build a smart alert system on GCP. You’ll detect, filter, and route security threats based on severity and business risk. 1. Enable SCC and Configure Detectors gcloud services enable securitycenter.googleapis.com gcloud services enable securitycenter.googleapis.com gcloud scc settings update \
--organization=ORG_ID \
--enable-service-container-threat-detection \
--enable-service-security-health-analytics gcloud scc settings update \
--organization=ORG_ID \
--enable-service-container-threat-detection \
--enable-service-security-health-analytics Enable Security Health Analytics, Event Threat Detection, and Container Threat Detection. These help you spot issues early and keep your cloud environment safe and manageable. 2. Create Tier-Based Notification Filters Use SecurityMarks or resource type to define tiers: gcloud scc findings list \
--organization=ORG_ID \
--filter="category=\"PUBLIC_BUCKET_ACL\" AND state=\"ACTIVE\"" gcloud scc findings list \
--organization=ORG_ID \
--filter="category=\"PUBLIC_BUCKET_ACL\" AND state=\"ACTIVE\"" Tier

Example Findings



🔴 Tier 1

SERVICE_ACCOUNT_KEY_LEAKED, CRYPTO_MINER_ACTIVE



🟠 Tier 2

OPEN_FIREWALL_RULE, SQL_LOGGING_DISABLED



🟢 Tier 3

BUCKET_LOGGING_DISABLED, NON_COMPLIANT_TLS_POLICY Tier

Example Findings



🔴 Tier 1

SERVICE_ACCOUNT_KEY_LEAKED, CRYPTO_MINER_ACTIVE



🟠 Tier 2

OPEN_FIREWALL_RULE, SQL_LOGGING_DISABLED



🟢 Tier 3

BUCKET_LOGGING_DISABLED, NON_COMPLIANT_TLS_POLICY Tier

Example Findings Tier Tier Tier Example Findings Example Findings Example Findings 🔴 Tier 1

SERVICE_ACCOUNT_KEY_LEAKED, CRYPTO_MINER_ACTIVE 🔴 Tier 1 🔴 Tier 1 SERVICE_ACCOUNT_KEY_LEAKED, CRYPTO_MINER_ACTIVE SERVICE_ACCOUNT_KEY_LEAKED, CRYPTO_MINER_ACTIVE 🟠 Tier 2

OPEN_FIREWALL_RULE, SQL_LOGGING_DISABLED 🟠 Tier 2 🟠 Tier 2 OPEN_FIREWALL_RULE, SQL_LOGGING_DISABLED OPEN_FIREWALL_RULE, SQL_LOGGING_DISABLED 🟢 Tier 3

BUCKET_LOGGING_DISABLED, NON_COMPLIANT_TLS_POLICY 🟢 Tier 3 🟢 Tier 3 BUCKET_LOGGING_DISABLED, NON_COMPLIANT_TLS_POLICY BUCKET_LOGGING_DISABLED, NON_COMPLIANT_TLS_POLICY 3. Route Alerts via Pub/Sub + Cloud Functions Create Pub/Sub Topic gcloud pubsub topics create scc-findigs-topic gcloud pubsub topics create scc-findigs-topic Enable Notifications gcloud scc notification create "tiered-alerts" \
--organization=ORG_ID \
--pubsub-topic="projects/PROJECT_ID/topics/scc-findings-topic" \
--filter="severity=\"HIGH\"" gcloud scc notification create "tiered-alerts" \
--organization=ORG_ID \
--pubsub-topic="projects/PROJECT_ID/topics/scc-findings-topic" \
--filter="severity=\"HIGH\"" 4. Create a Cloud Function to Parse and Route def route_finding(event, context):
    import json
    finding = json.loads(base64.b64decode(event['data']).decode('utf-8'))

    category = finding.get("category", "")
    severity = finding.get("severity", "")
    
    if severity == "CRITICAL" or "CRYPTO_MINER" in category:
        send_to_pagerduty(finding)
    elif severity == "HIGH":
        create_jira_ticket(finding)
    else:
        log_to_bigquery(finding) def route_finding(event, context):
    import json
    finding = json.loads(base64.b64decode(event['data']).decode('utf-8'))

    category = finding.get("category", "")
    severity = finding.get("severity", "")
    
    if severity == "CRITICAL" or "CRYPTO_MINER" in category:
        send_to_pagerduty(finding)
    elif severity == "HIGH":
        create_jira_ticket(finding)
    else:
        log_to_bigquery(finding) Use this to enforce escalation paths that match your business priorities. It sends important alerts to the right team quickly. That means serious threats get handled fast, and smaller ones don’t slow things down. 5. Aggregate and Report in BigQuery Export all findings to BigQuery: gcloud scc findings export-to-bigquery \
--dataset=security_findings \
--organization=ORG_ID gcloud scc findings export-to-bigquery \
--dataset=security_findings \
--organization=ORG_ID Create dashboards in Looker Studio or Chronicle to visualize: Finding types over time
SLA violations
Response coverage by tier Finding types over time SLA violations Response coverage by tier Advanced Add-Ons Integration

Purpose



Chronicle SIEM

Deep threat correlation and timeline building



PagerDuty

Real-time incident response for Tier 1 threats



Jira + Opsgenie

Automated ticketing for Tier 2, Tier 3 findings



Terraform Modules

Codify SCC configurations for GitOps pipelines



Vertex AI + BQML

Predict the likelihood of escalation using ML Integration

Purpose



Chronicle SIEM

Deep threat correlation and timeline building



PagerDuty

Real-time incident response for Tier 1 threats



Jira + Opsgenie

Automated ticketing for Tier 2, Tier 3 findings



Terraform Modules

Codify SCC configurations for GitOps pipelines



Vertex AI + BQML

Predict the likelihood of escalation using ML Integration

Purpose Integration Integration Integration Purpose Purpose Purpose Chronicle SIEM

Deep threat correlation and timeline building Chronicle SIEM Chronicle SIEM Deep threat correlation and timeline building Deep threat correlation and timeline building PagerDuty

Real-time incident response for Tier 1 threats PagerDuty PagerDuty Real-time incident response for Tier 1 threats Real-time incident response for Tier 1 threats Jira + Opsgenie

Automated ticketing for Tier 2, Tier 3 findings Jira + Opsgenie Jira + Opsgenie Automated ticketing for Tier 2, Tier 3 findings Automated ticketing for Tier 2, Tier 3 findings Terraform Modules

Codify SCC configurations for GitOps pipelines Terraform Modules Terraform Modules Codify SCC configurations for GitOps pipelines Codify SCC configurations for GitOps pipelines Vertex AI + BQML

Predict the likelihood of escalation using ML Vertex AI + BQML Vertex AI + BQML Predict the likelihood of escalation using ML Predict the likelihood of escalation using ML This table highlights powerful add-ons that enhance your alerting system. These tools help you automate responses, track issues, and even predict threat escalation. While optional, integrating them maximizes speed, accuracy, and control across your cloud security workflows. Cloud Threat Detection Checklist This table shows the key steps to set up threat detection in Google Cloud. It pairs each action with the tool needed, helping you track, filter, and respond to security alerts more effectively. Action

Tool



Enable SCC + SHA

gcloud CLI or Terraform



Define Severity + Risk Filters

SCC Filters + SecurityMarks



Route Findings to Pub/Sub

gcloud scc notifications



Parse and Escalate Alerts

Cloud Functions + API Integrations



Archive and Analyze

BigQuery, Looker Studio, Chronicle



Monitor SLAs and Drift

Custom Dashboards or Data Studio Action

Tool



Enable SCC + SHA

gcloud CLI or Terraform



Define Severity + Risk Filters

SCC Filters + SecurityMarks



Route Findings to Pub/Sub

gcloud scc notifications



Parse and Escalate Alerts

Cloud Functions + API Integrations



Archive and Analyze

BigQuery, Looker Studio, Chronicle



Monitor SLAs and Drift

Custom Dashboards or Data Studio Action

Tool Action Action Action Tool Tool Tool Enable SCC + SHA

gcloud CLI or Terraform Enable SCC + SHA Enable SCC + SHA gcloud CLI or Terraform gcloud CLI or Terraform Define Severity + Risk Filters

SCC Filters + SecurityMarks Define Severity + Risk Filters Define Severity + Risk Filters SCC Filters + SecurityMarks SCC Filters + SecurityMarks Route Findings to Pub/Sub

gcloud scc notifications Route Findings to Pub/Sub Route Findings to Pub/Sub gcloud scc notifications gcloud scc notifications Parse and Escalate Alerts

Cloud Functions + API Integrations Parse and Escalate Alerts Parse and Escalate Alerts Cloud Functions + API Integrations Cloud Functions + API Integrations Archive and Analyze

BigQuery, Looker Studio, Chronicle Archive and Analyze Archive and Analyze BigQuery, Looker Studio, Chronicle BigQuery, Looker Studio, Chronicle Monitor SLAs and Drift

Custom Dashboards or Data Studio Monitor SLAs and Drift Monitor SLAs and Drift Custom Dashboards or Data Studio Custom Dashboards or Data Studio Conclusion Security Command Center helps you do more than just watch for threats. It helps your team quickly focus on the most important risks. A tiered alert system lets you handle serious threats first without getting overwhelmed by minor ones. Tools like Pub Sub, BigQuery, and Security Health Analytics help you handle alerts clearly. This makes your response faster, work easier, and your cloud safer without extra effort.

This story contains new, firsthand information uncovered by the writer.

Dash

Terra

Google

Cloud Threat Detection with Google Security Command Center - Building a Tiered Alerting System

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Best Practices for Securing Cloud Environments Against Cyber Threats

105 Stories To Learn About K8s

10 Ways to Future-Proof Your Business With Cloud

10 Ways to Reduce Data Loss and Potential Downtime Of Your Database

10 Upcoming DevOps Conferences for 2018

101 Stories To Learn About Cloud Infrastructure

Best Practices for Securing Cloud Environments Against Cyber Threats

105 Stories To Learn About K8s

10 Ways to Future-Proof Your Business With Cloud

10 Ways to Reduce Data Loss and Potential Downtime Of Your Database

10 Upcoming DevOps Conferences for 2018

101 Stories To Learn About Cloud Infrastructure

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps