Which approach best enables low-latency ingestion of data from a Pub/Sub topic in a separate project into SecOps using a dedicated ingestion key?

• A. Push data to Cloud Logging; modify export filters.
• B. Enable Chronicle API in Pub/Sub project to push to SecOps.
• C. Create a Cloud Run function subscribed to Pub/Sub and use a SecOps Ingestion API key to push data to SecOps.
• D. Send Pub/Sub messages to Cloud Storage; create a feed.

Answer: (C)

When you want near-real-time ingestion from a Pub/Sub topic in another project into SecOps using a dedicated ingestion key, the best approach is to forward each Pub/Sub message immediately to SecOps with a lightweight bridge. A Cloud Run service subscribed to the Pub/Sub topic acts as that bridge: it runs on demand, scales with traffic, and processes messages with minimal overhead. Each received message is promptly posted to the SecOps Ingestion API using the dedicated API key, keeping the path direct and latency low. This avoids extra steps and buffering that come with exporting data to Cloud Logging, or routing through Cloud Storage, or looping through a Chronicle API, all of which introduce delays or additional hops. With the Cloud Run forwarder, you get a simple, real-time pipeline and can implement retries and proper authentication to maintain reliability.