A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the…

Streaming all logs to BigQuery and providing direct SIEM access is not the most secure or efficient method for real-time log ingestion by a SIEM and could expose more data than necessary.

Log views provide a filtered perspective within Cloud Logging, but they do not offer a mechanism for exporting or streaming logs to an external, on-premises SIEM.

A log sink allows filtering for specific logs and exporting them to Pub/Sub, which acts as a durable message queue. The on-premises SIEM can then securely pull these logs from Pub/Sub, ensuring only necessary data is transferred and minimizing direct exposure to the Google Cloud environment.

Storing logs in a Cloud Storage bucket and granting a service account direct access provides static storage, which may not be suitable for real-time SIEM ingestion and could pose a higher data exposure risk compared to a Pub/Sub pull model.