How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?
A) Send all logs to the SIEM system via an existing protocol such as syslog.
B) Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
C) Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
D) Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

Question

Quizplus · Accepted Answer

Using Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic allows for scalable and reliable delivery of logs, which can then be processed and sent to the SIEM system using Dataflow.

How Should a Customer Reliably Deliver Stackdriver Logs from GCP