Question

Your security operations team runs an on-premises Splunk SIEM and must ingest all Cloud Audit Logs from every project in your organization in near real time for correlation and alerting. The pipeline must be centrally managed, minimize per-project configuration, and stream logs continuously rather than in batch. Which approach should you implement?

Accepted Answer

Create an organization-level aggregated log sink that routes logs to a Pub/Sub topic, and configure the Splunk Add-on for Google Cloud (Dataflow) to pull from that subscription.

Answer

Create a log sink in each project that exports logs to a BigQuery dataset, then schedule a query that Splunk polls hourly via the BigQuery API.

Answer

Configure an organization-level aggregated sink to a Cloud Storage bucket and have Splunk's file monitor input read the exported JSON objects.

Answer

Enable Security Command Center continuous export to Pub/Sub and forward the findings to Splunk using the SCC connector.