Question

Your SOC has deployed Cloud IDS to inspect north-south and east-west traffic in a production VPC. Leadership wants Cloud IDS threat detections to appear in Google SecOps so analysts can correlate them with endpoint and identity telemetry in a single console. You want the most operationally sustainable path that minimizes custom engineering and preserves normalized fields for correlation. Which approach should you implement?

Accepted Answer

Route Cloud IDS threat logs to Cloud Logging, export them to a Pub/Sub topic, and ingest into SecOps using the native Google Cloud ingestion feed so they are parsed into UDM automatically

Answer

Write a custom parser in SecOps for raw Cloud IDS packet captures and forward them via a self-managed forwarder on a dedicated VM

Answer

Configure SecOps to poll the Cloud IDS API directly on a scheduled basis and store results as raw unstructured logs

Answer

Send Cloud IDS alerts only to Security Command Center and rely on SCC as the single pane of glass instead of SecOps