An enterprise organization requires real-time security monitoring across all projects in its Google Cloud hierarchy. The security architecture team must stream both Cloud Storage Data Access audit logs and Security Command Center (SCC) Event Threat Detection findings to an on-premises Security Information and Event Management (SIEM) system. The solution must adhere to the principle of least privilege and native Google Cloud security recommendations. Which TWO actions should the security architect perform to meet these requirements?
- Create an organization-level aggregated Cloud Logging sink configured with a filter for Data Access audit logs and set its destination to a central Pub/Sub topic monitored by the SIEM collector.Answer
- Configure Security Command Center continuous export at the organization level to stream high-severity security findings directly to a designated Pub/Sub topic.Answer
- CGrant the primitive Owner role (roles/owner) to the dedicated service account running the SIEM log collector to ensure full read access to all log sinks and security findings.
- DEnforce Customer-Supplied Encryption Keys (CSEK) on the Pub/Sub topics to manage raw encryption keys locally for SIEM log transport.
Answer
To centrally stream security audit logs and threat findings to a SIEM while maintaining minimal necessary privileges, the architect must set up an organization-level aggregated log sink routing Data Access logs to Pub/Sub, and enable Security Command Center continuous export at the organization level to stream findings to Pub/Sub.
Centralizing security telemetry requires organization-wide aggregated log sinks for audit logs and continuous export for Security Command Center findings. Both features publish directly to Pub/Sub topics, enabling secure and real-time ingestion by third-party SIEM collectors.
Step-by-Step Solution
Key Concept
Centralized Security Log Aggregation and Continuous Findings Export