Professional Cloud Security EngineerManaging operationsEasy
A security operations center (SOC) team needs to ingest security logs from various Google Cloud services, on-premises systems, and third-party SaaS applications into a single platform for centralized analysis and threat hunting. They require long-term retention, correlation capabilities across diverse data sources, and automated detection of advanced threats. Which Google Cloud service is best suited for this requirement?
- ACloud Logging
- BChronicle Security Operations
- CCloud Monitoring
- DSecurity Command Center
Show answer & explanationAnswer & explanation
Correct answer: B. Chronicle Security Operations
Chronicle Security Operations (formerly Chronicle SIEM) is specifically designed for centralized security analytics, threat detection, and threat hunting across an organization's entire IT landscape, including Google Cloud, on-premises, and third-party data sources. It offers long-term data retention and powerful correlation capabilities.
Why the other options are wrong
- A. Cloud Logging is for collecting, viewing, and routing logs from Google Cloud and some on-premises sources, but lacks the advanced security analytics and threat hunting capabilities of a SIEM.
- C. Cloud Monitoring is for collecting metrics, events, and metadata from Google Cloud and some third-party applications, primarily for operational monitoring and alerting, not advanced security analytics.
- D. Security Command Center primarily focuses on vulnerability management, threat detection, and compliance for Google Cloud resources, not a general-purpose SIEM for all data sources.
Chronicle Security Operations
A cloud-native security analytics platform that unifies security telemetry from an entire enterprise to detect, investigate, and respond to threats at scale.
- Centralized SIEM functionality
- Long-term data retention
- Threat hunting and correlation across diverse data sources
Memory trick: Chronicle's quest: Gather all security data to hunt for threats.