Question

A security operations engineer is onboarding dozens of new log sources into Google SecOps. Leadership has mandated that authentication and identity logs (from the corporate IdP and VPN gateways) must always be searchable and processed ahead of high-volume, lower-value logs such as verbose CDN access logs during periods of ingestion backpressure. Which approach best ensures the identity-related telemetry is consistently prioritized within the SecOps data pipeline?

Accepted Answer

Apply ingestion labels to the log sources and configure log source prioritization so identity logs are processed ahead of lower-value sources during contention

Answer

Increase the data retention period on the identity log types so they persist longer than the CDN logs

Answer

Write a custom parser for the identity logs that runs before the CDN parser executes

Answer

Create a reference list of identity source IPs and enrich CDN events with it to raise their relative importance