Professional Cloud Security EngineerDemo

Question

How can a customer reliably deliver Stackdriver logs from GCP to an on-premises SIEM system?

A Send all logs to the SIEM system via an existing protocol such as syslog.
B Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
C Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
D Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

Explanation

An organization-level aggregated log sink centrally routes logs from child resources to a Cloud Pub/Sub topic. Pub/Sub provides decoupled, near-real-time message delivery for third-party integrations, while Dataflow can consume, transform if needed, and forward the log stream to an on-premises SIEM.

Learn more

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ292

Community Discussion