A cloud security architect is designing an enterprise security monitoring strategy for a multi-project Google Cloud organization. The security operations team requires real-time automated threat detection for security anomalies across all infrastructure and wants to centralize all organization-wide audit logs for export to an external Security Information and Event Management (SIEM) system. Which TWO architectural steps should the architect take to satisfy these requirements?
- Enable Security Command Center Premium at the organization level to leverage Event Threat Detection for real-time analysis of audit log streams and security findings.Cevap
- Create an aggregated log sink at the organization root with an inclusion filter for audit logs, setting a centralized Pub/Sub topic as the export destination.Cevap
- CGrant the primitive Owner role to the dedicated logging service account at the organization level to ensure comprehensive read access across all project log buckets.
- DConfigure Customer-Supplied Encryption Keys (CSEK) on the target log storage sinks to meet enterprise key management compliance requirements.
Cevap
To establish real-time threat detection and centralized log export for an enterprise Google Cloud organization, you should enable Security Command Center Premium at the organization level for Event Threat Detection, and create an organization-level aggregated log sink targeting a Pub/Sub topic connected to the external SIEM.
Enabling Security Command Center Premium at the organization root allows Event Threat Detection to analyze audit log streams across all projects automatically. Combining this with an organization-level aggregated log sink routing to Pub/Sub provides scalable, real-time log ingestion into an external SIEM.
Adım Adım Çözüm
Anahtar Kavram
Organization-wide log aggregation and Security Command Center Event Threat Detection integration