Export logs to Cloud Logging

Premium and Enterprise service tiers (requires organization-level activation)

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

On the Continuous exports tab, you can set up logging for Event Threat Detection and Container Threat Detection findings. Findings are exported to the Cloud Logging project that you select.

To use Cloud Logging export, you must activate Security Command Center at the organization level.

Depending on the quantity of information, Cloud Logging costs can be significant. To understand your usage of the service and its cost, see Google Cloud Observability pricing.

Do the following to configure export:

1. In the Google Cloud console, go to Security Command Center.

   Go to Security Command Center

2. Select your organization.

3. Click Settings.

4. Click the Continuous Exports tab.

5. In Export name, click Logging Export.

6. In Sinks, turn on Log Findings to Logging.

7. In Logging project, enter or search for the project where you want to log findings.

8. Click Save.

When Event Threat Detection and Container Threat Detection write logs, each log entry includes the threat_detector resource type and contains the same information as findings. For instructions on reviewing logs, see Using Event Threat Detection and Using Container Threat Detection.