To monitor audit logs related to data feeds in Google SecOps, which action should you take?

• A. Enable Data Access and Admin Activity audit logs in Cloud Logging and ingest into SecOps SIEM.
• B. Ingest the Google SecOps audit logs into SecOps SIEM for monitoring.
• C. Monitor SecOps SOAR user activity logs for administrative activity.
• D. Configure Cloud Logging filter to ingest audit logs related to data feeds.

Answer: (B)

Centralizing audit logs in the SecOps SIEM is the approach that gives you complete visibility into data-feed activity. By ingesting the Google SecOps audit logs into the SecOps SIEM, you create a single source of truth for all audit events, so you can see who performed actions on data feeds, when they did it, and from where. This setup enables real-time monitoring, correlation with other security events, and faster investigations when something looks suspicious or unauthorized.

Relying only on enabling certain Cloud Logging logs or filtering to data-feed events can leave gaps in coverage or delay detection, and focusing solely on SOAR user activity logs misses the broader audit trail tied to data feeds. Ingesting the official SecOps audit logs into the SIEM provides comprehensive, centralized visibility and actionable alerts for data-feed related activity.