`scc_findings_siem` — version 1.0

Source: presets/scc/scc-findings-siem.satz

Purpose

Security Command Center findings, pulled off the topic by an external SIEM.

The other answer to "who gets told", for a customer whose security team works in Microsoft Sentinel, Defender for Cloud, Splunk or QRadar rather than in a mailbox.

NEEDS presets/scc/scc-notifications.satz: this fragment attaches to the topic that pack creates and takes the same project. Used without it, the compile stops with unknown param 'scc_notification_project'.

TWO RESOURCES, AND THE SECOND IS THE ONE THAT IS FORGOTTEN. A pull subscription on the findings topic, and roles/pubsub.subscriber for the identity the SIEM reads as — without the grant the connector authenticates, finds the subscription, and reads nothing. The subscription is a PULL subscription: every SIEM connector in this class pulls, and a push endpoint would need a URL the estate cannot know.

THE IDENTITY IS ASKED, AND HAS NO DEFAULT. It is a full IAM member string, which for Microsoft Sentinel is the service account presets/integrations/microsoft-sentinel.satz creates and for Defender for Cloud the one its onboarding script names. Defaulting it to either would tie Security Command Center to one vendor's pack, and a wrong default here is a subscription nobody can read.

ALONGSIDE A MAILBOX, NOT INSTEAD OF IT. scc-findings-mail.satz makes its own subscription under its own address, so an estate can run both: the SIEM ingests every finding and the mailbox is told that findings are arriving.

NO CLAIM. No catalog control covers Security Command Center, so this pack witnesses nothing.

Use it

params {
  // the pack's own defaults — copy only the lines you change
  scc_siem_subscriber = ""
  scc_siem_subscription_name = "{customer_shortname}-scc-findings-siem"
  scc_siem_retention = "604800s"
  scc_siem_ack_deadline_seconds = 60
}

use "presets/scc/scc-findings-siem.satz"

Needs from outside the pack:

customer_shortname — declared by estate_core; use one of them alongside, or declare it in the estate.
scc_notification_project — declared by scc_notifications; use one of them alongside, or declare it in the estate.

Params

param	default
`scc_siem_subscriber`	`""`
`scc_siem_subscription_name`	`"{customer_shortname}-scc-findings-siem"`
`scc_siem_retention`	`"604800s"`
`scc_siem_ack_deadline_seconds`	`60`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`scc_siem_subscriber`	Which identity does the SIEM read findings as (a full IAM member, e.g. serviceAccount:sentinel-service-account@PROJECT.iam.gserviceaccount.com)?	edit	high	—

scc_siem_subscriber — Whoever holds this reads every finding in the organisation. For Microsoft Sentinel it is the service account the Sentinel pack creates; for Defender for Cloud the one its onboarding script names; for another SIEM whatever its connector authenticates as. There is no default, because a wrong one is a subscription the connector cannot read and findings that pile up until they expire.

Contributes

resource type	labels
`google_pubsub_subscription`	`scc_findings_siem`
`google_pubsub_subscription_iam_member`	`scc_findings_siem_reader`

Claims

None — this pack proves no control by itself.

History

version	date	change
1.0	2026-09-12	first version: the SIEM's own pull subscription on the findings topic and `roles/pubsub.subscriber` for the identity it reads as — without that grant a connector authenticates and reads nothing. The identity is asked and has no default: defaulting it would tie SCC to one vendor's pack. Runs alongside the mailbox, each with its own subscription

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No notes yet.

scc_findings_siem — version 1.0