Question

A SOC team at a healthcare company runs workloads across multiple IaaS accounts in a single public cloud provider. They need to centralize security telemetry — control-plane API activity, guest OS logs, and network flow logs — into their SIEM for real-time monitoring. The cloud provider offers a native, fully managed service that streams these log sources to a subscribed destination without requiring software installation on each instance. The SOC lead wants the most operationally reliable approach that minimizes gaps in control-plane and network-layer coverage. Which approach best meets this requirement?

Accepted Answer

Enable the provider's native control-plane audit logging and network flow logging services and stream them to the SIEM, while using host-based agents only for guest OS logs that cannot be captured at the platform layer

Answer

Deploy a third-party logging agent on every guest instance and rely solely on those agents to forward all telemetry, including control-plane and network flow data, to the SIEM

Answer

Configure each account to write all logs to a local disk on individual instances and have the SOC periodically pull them via scheduled SSH sessions

Answer

Rely on the provider's default retention of logs in the console and have analysts log into each account's dashboard to review activity during business hours