To pull SCC findings into SecOps for SOAR actions, how should you configure the connection?

• A. Install Google Rapid Response integration.
• B. Install the SCC integration from SecOps Marketplace; grant SCC API appropriate IAM roles; configure integration using generated API key scoped to SCC API.
• C. Create Pub/Sub topic with NotificationConfig and push subscription; grant SecOps service account read access.
• D. Same as C but create a new SecOps service account in the project.

Answer: (B)

The way to pull SCC findings into SecOps for SOAR actions is to use the official SCC integration from the SecOps Marketplace and authenticate it with proper IAM permissions and a scoped API key. This integration is built to securely connect SecOps with Security Command Center, handling the data retrieval and any necessary mapping for your automation workflows. Install the SCC integration, then grant the integration’s service identity the appropriate IAM roles to read SCC findings (for example, a findings viewer role at the right scope). Configure the integration with a generated API key that is scoped to the SCC API so the calls are authenticated and constrained to the necessary endpoints. This approach provides a straightforward, permission-based pull mechanism that SecOps can reliably use for SOAR actions. Using a Pub/Sub push path would introduce a different notification-based flow and adds extra steps, while creating a new SecOps service account doesn’t add value beyond what the configured integration already requires.