Question

A security operations engineer is expanding Google SecOps coverage to include an on-premises firewall fleet that emits high-volume syslog over UDP. The devices sit in a segmented data center network with no direct outbound internet access except through a hardened egress proxy. The team needs a reliable, buffered ingestion path that preserves event ordering and can be centrally managed. Which ingestion mechanism should the engineer deploy to onboard this telemetry into SecOps?

Accepted Answer

Deploy the SecOps forwarder (Bindplane/Chronicle forwarder) inside the data center to collect syslog locally and forward batched data to SecOps through the egress proxy

Answer

Configure each firewall to POST logs directly to the SecOps ingestion API using a webhook feed

Answer

Enable the native Cloud IDS integration to automatically pull the on-premises firewall logs

Answer

Point the firewalls' syslog output directly at the public SecOps UDP ingestion endpoint