A is not correct because creating a metric for every credit card will not scale well.
B is not correct because it will exclude the transactions that are relevant to the security team.
C is not correct because while we could use AutoML to build models, this solution is incomplete without deploying and running the model, as well as wiring them up with some consumer service.
D is correct because this will capture the important events and pass them to Pub/Sub which in turn can send the message to a consumer service like a chat notification webhook.
https://cloud.google.com/logging/docs/export/configure_export_v2