How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

Question

Options

• ASend all logs to the SIEM system via an existing protocol such as syslog.
• BConfigure every project to export all their logs to a common BigQuery DataSet, which will be
• CConfigure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to
• DBuild a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON

• A
  3% (1)
• B
  13% (4)
• C
  77% (24)
• D
  6% (2)

Explanation

Configuring Organizational Log Sinks to export logs to a Cloud Pub/Sub topic is the recommended GCP pattern for reliable, scalable log delivery to external systems. Pub/Sub provides durable, ordered message delivery with at-least-once guarantees, and a subscriber (running on-premises or in a Compute Engine instance) can forward those messages to the SIEM. Option A (direct syslog) lacks the reliability and scalability of Pub/Sub. Option B (BigQuery) is ideal for analytics but introduces latency unsuitable for SIEM real-time ingestion. Option D (REST polling) creates custom infrastructure complexity and risks gaps between polls.

No community discussion yet for this question.