InboundCloud Platforms

Google Cloud SCC + Alert24

Stream events from Google Cloud SCC into Alert24 to correlate changes with incidents and shorten time to resolution.

Start Free Trial See Pricing

Receive Google Cloud Security Command Center threat and vulnerability findings via Pub/Sub.

Auto-detected payloads

Alert24 recognizes Google Cloud SCC webhooks out of the box and maps fields to incidents automatically.

On-call routing & escalations

Page the right engineer over SMS, voice, push, email, or chat with policy-driven escalations.

Auto-updating status pages

Promote incidents to a public or private status page with one click and keep customers informed.

Change correlation & AI RCA

Recent deploys, infra updates, and feature flag flips surface alongside the incident for faster root cause.

Quick Setup

Copy Webhook URL

Go to your Alert24 dashboard and copy the webhook URL for Google Cloud SCC.

Configure Google Cloud SCC

Add the webhook URL in your Google Cloud SCC settings.

Auto-Detected

Alert24 auto-detects Google Cloud SCC payloads and maps them to incidents.

Step-by-Step Setup Instructions

Google Cloud SCC Webhook Setup

1.In Google Cloud Console, go to Security → Security Command Center

2.Create a NotificationConfig for the findings you want to receive:

gcloud scc notifications create alert24-notifications \
  --organization=<ORG_ID> \
  --pubsub-topic=projects/<PROJECT_ID>/topics/scc-findings \
  --filter='state="ACTIVE"'

3.Create a Pub/Sub push subscription on the topic:

gcloud pubsub subscriptions create alert24-push \
  --topic=scc-findings \
  --push-endpoint=<WEBHOOK_URL>

4.Findings will be delivered as base64-encoded Pub/Sub messages

Example Webhook Payload

This is a sample payload that Google Cloud SCC sends to Alert24 when an alert fires.

{
  "message": {
    "data": "eyJub3RpZmljYXRpb25Db25maWdOYW1lIjoib3JnYW5pemF0aW9ucy8xMjM0L25vdGlmaWNhdGlvbkNvbmZpZ3MvYWxlcnQyNCJ9",
    "messageId": "1234567890",
    "publishTime": "2024-01-15T10:30:00Z"
  },
  "subscription": "projects/my-project/subscriptions/alert24-push",
  "notificationConfigName": "organizations/123456789/notificationConfigs/alert24",
  "finding": {
    "name": "organizations/123456789/sources/1/findings/abc123",
    "state": "ACTIVE",
    "category": "PERSISTENCE: New API Key Created",
    "findingClass": "THREAT",
    "severity": "HIGH"
  }
}