Export logs to Cloud Logging

On the Continuous exports tab, you can set up logging for Event Threat Detection and Container Threat Detection findings. Findings are exported to the Cloud Logging project that you select.

To use Cloud Logging export, you must activate Security Command Center at the organization level.

Depending on the quantity of information, Cloud Logging costs can be significant. To understand your usage of the service and its cost, see Google Cloud Observability pricing.

For information about how to log findings, click the tab for your service tier:

Premium

  1. In the Google Cloud console, go to the Security Command Center page. Go to Security Command Center
  2. Select your organization.
  3. Click Settings.
  4. Click the Continuous Exports tab.
  5. In Export name, click Logging Export.
  6. In Sinks, turn on Log Findings to Logging.
  7. In Logging project, enter or search for the project where you want to log findings.
  8. Click Save.

Enterprise

  1. In the Google Cloud console, go to the Security Command Center page. Go to Security Command Center
  2. Select your organization.
  3. Click SCC Settings.
  4. Click the Continuous Exports tab.
  5. In Export name, click Logging Export.
  6. In Sinks, turn on Log Findings to Logging.
  7. In Logging project, enter or search for the project where you want to log findings.
  8. Click Save.

When Event Threat Detection and Container Threat Detection write logs, each log entry includes the threat_detector resource type and contains the same information as findings. For instructions on reviewing logs, see Using Event Threat Detection and Using Container Threat Detection.