You need real-time monitoring of data ingestion into SecOps and automatic notification if any data source stops ingesting, minimizing cost. What should you do?

• A. Looker dashboards + Looker alerting policy.
• B. Looker dashboards + Cloud Monitoring alerts.
• C. Use SecOps SIEM dashboards + Cloud Logging alert policy.
• D. Use SecOps SIEM dashboards + Cloud Monitoring alert policy.

Answer: (D)

The key idea is to monitor ingestion health with metrics and alert on them in real time, while keeping the security view centralized in your SIEM.

Use SecOps SIEM dashboards to provide a centralized view of ingestion health and security events, and pair that with a Cloud Monitoring alert policy that watches a metric signalling data ingestion health (such as events ingested per source, lag, or a failure rate). When the metric drops below the expected level or a latency spike occurs, Cloud Monitoring can automatically notify the on-call channel. This approach gives fast, scalable alerts with lower ongoing cost, and keeps ingestion visibility aligned with security operations.

Opting for BI-focused Looker alerts or relying on log-based alerts alone is less suited for real-time ingestion health. Looker alerts are primarily for dashboards and BI workflows, which can add cost and delay. Log-based alerts depend on logs being produced; if ingestion stops, logs may disappear or be delayed, making alerts unreliable. Therefore, the combination of SIEM dashboards plus metric-based alerting in Cloud Monitoring best meets real-time detection, integration with SecOps, and cost efficiency.