Export logs to Cloud Logging

Premium and Enterprise (Deprecated) service tiers (requires organization-level activation)

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

Security Command Center lets you export Event Threat Detection and Container Threat Detection findings to Logging. This task helps you centralize security telemetry and configure log-based alerts.

Exporting findings requires activating Security Command Center at the organization level using the Premium or Enterprise tier. Ingestion and storage costs depend on finding volume. To manage expenses, see Google Cloud Observability pricing.

Depending on the quantity of information, Cloud Logging costs can be significant. To understand your usage of the service and its cost, see Google Cloud Observability pricing.

To configure export, do the following:

1. In the Google Cloud console, go to Security Command Center.

   Go to Security Command Center

2. Select your organization.

3. Click Settings.

4. Click the Continuous Exports tab.

5. In Export name, click Logging Export.

6. In Sinks, turn on Log findings to Logging.

7. In Logging project, enter or search for the project where you want to log findings.

8. Click Save.

When Event Threat Detection and Container Threat Detection write logs, each log entry includes the threat_detector resource type and contains the same information as findings. For instructions on reviewing logs, see Using Event Threat Detection or Using Container Threat Detection.