Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ123

Observability

You are deploying Google Security Operations (SecOps) with multiple log sources. You need to closely monitor the health of the ingestion pipeline’s forwarders and collection agents, and identify silent sources within five minutes. What should you do?

  • A Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
  • B Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
  • C Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
  • D Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
Explanation

Google SecOps silent-forwarder and silent-collection-agent monitoring is implemented through a Cloud Monitoring alert policy that groups metrics by collector_id and uses a metric-absence condition. Configuring the rolling window and absence duration to a combined five minutes detects collectors that stop reporting within the required interval.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!