Veronica Lauren has an experience of 4 years as a cloud security engineer. Recently, she joined an IT company as a senior cloud security engineer. In…

Google Cloud's Event Threat Detection is a managed service within the Security Command Center designed specifically for the tasks Veronica needs to perform. It consumes logs from Cloud Logging and VPC Flow Logs to apply threat intelligence and detectors that identify malicious activity in near real-time. Its built-in detectors are explicitly designed to find threats such as malware, brute-force SSH attempts against cloud resources, and cryptomining activity. This service directly aligns with the requirement to monitor logging streams to detect active security breaches.

B. Web Security Scanner is a vulnerability assessment tool for web applications; it does not monitor logs for active threats like malware or brute-force attacks.
C. Container Threat Detection is specialized for detecting runtime threats within containerized environments, not for general threats like SSH brute-force on VMs.
D. Security Health Analytics is a posture management service that identifies misconfigurations in cloud resources, rather than detecting active, ongoing attacks by analyzing logs.

1. Google Cloud. (n.d.). Event Threat Detection overview. Google Cloud Documentation. Retrieved from https://cloud.google.com/security-command-center/docs/event-threat-detection-overview. (The official documentation states, "Event Threat Detection detects threats in your logs... Examples of the types of threats it detects are malware, cryptomining, and outgoing DDoS attacks.")

2. Google Cloud. (n.d.). Event Threat Detection rules. Google Cloud Documentation. Retrieved from https://cloud.google.com/security-command-center/docs/event-threat-detection-rules. (This page lists specific detection rules, including "SSH Brute Force" and "Cryptomining").