Which option would you use to monitor data feed audit logs by ingesting into SecOps SIEM?

• A. Enable Data Access and Admin Activity audit logs in Cloud Logging and ingest into SecOps SIEM.
• B. Ingest the Google SecOps audit logs into SecOps SIEM for monitoring.
• C. Monitor SecOps SOAR user activity logs for administrative activity.
• D. Configure Cloud Logging filter to ingest audit logs related to data feeds.

Answer: (B)

Centralized security monitoring relies on feeding the source audit events directly into your SIEM. Ingesting the Google SecOps audit logs into the SecOps SIEM creates a single, authoritative stream of data about who did what with data feeds, when, and from where. With these logs in the SIEM, you can correlate events, set alerts, and perform investigations quickly, which is exactly what you need to monitor data feed activity effectively.

Relying on Cloud Logging alone or on SOAR activity logs doesn’t provide the same comprehensive, centralized view of data feed audit events, and simply filtering Cloud Logging without forwarding to the SIEM leaves you with gaps in coverage.