A third-party application's data is published to a Pub/Sub topic in a separate project; push attempts to SecOps fail. Which low-latency approach is robust?

• A. Push data to Cloud Logging and modify direct ingestion export filter.
• B. Enable Chronicle API in the Pub/Sub project to push subscription to SecOps.
• C. Create a Cloud Run function subscribed to the Pub/Sub topic and use a SecOps Ingestion API key to push data to SecOps.
• D. Send Pub/Sub messages to Cloud Storage; create a feed; grant Storage Admin.

Answer: (C)

When you need low-latency, reliable delivery from a Pub/Sub topic to SecOps, the best approach is to use an event-driven compute resource that subscribes directly to Pub/Sub and forwards messages to SecOps as they arrive. A Cloud Run service subscribed to the Pub/Sub topic can receive each message with minimal delay and call the SecOps Ingestion API using the API key to push the data. This setup scales automatically, keeps processing close to where the data arrives, and lets you implement retries and error handling to ensure delivery remains robust.

Other paths add unnecessary hops or dependencies. Pushing data through Cloud Logging exports introduces extra latency and complexity and isn’t designed for real-time forward to an external system. A Chronicle API pathway ties you to another product and may not provide the simplest, fastest direct ingestion using an API key. Sending messages to Cloud Storage and creating a feed adds storage steps and potential delays, plus broader permission requirements, which is not ideal for real-time ingestion.