SecOps SOAR integration with SCC uses a service account with read access at the org level. Actions to update finding states fail due to permission issues. Which least-privilege change should you implement?

• A. Grant roles/securitycenter.findingsBulkMuteEditor at org level.
• B. Grant roles/securitycenter.findingsEditor at org level.
• C. Grant roles/iam.serviceAccountUser to itself.
• D. Regenerate service account key and update credentials.

Answer: (B)

The main idea is granting the minimal permission needed to update findings in Security Command Center. To change a finding’s state, the service account must have write access to findings. The findingsEditor role provides the necessary ability to edit findings (including updating their state) at the org level, which is the smallest permission set that enables the required action across the organization. Granting this at the org level gives the needed access without adding broader or unrelated capabilities.

The bulk mute editor role is too narrow for this task; it focuses on muting findings in bulk and may not cover general state updates. The other options aren’t about finding permissions at all—they deal with identity management or credentials, not the ability to modify findings.