Question

A security operations team ingests logs from dozens of sources into Google SecOps. Their monthly ingestion budget is fixed, but a newly onboarded verbose Windows DHCP log source is consuming a disproportionate share of the quota, crowding out higher-value authentication and EDR telemetry. The team must keep the DHCP data available for occasional IP-to-host attribution during investigations but does not need it in real-time detection rules. What is the MOST appropriate approach to align ingestion with detection priorities?

Accepted Answer

Route the DHCP logs to a lower-cost data tier or configure them for context/enrichment use rather than active detection, preserving quota for high-priority security telemetry

Answer

Stop ingesting the DHCP logs entirely to free the quota, and rely on network diagrams for IP-to-host attribution

Answer

Increase the overall ingestion budget and continue ingesting all sources at the same priority tier

Answer

Write a custom parser that drops most DHCP fields so the events are smaller, then feed them into all real-time detection rules