A multinational enterprise wants to implement a centralized log routing and analytical strategy across its Google Cloud organization. The security operations team defines the following requirements: Aggregate and store Cloud Audit Logs centrally in a dedicated security monitoring project. Perform SQL-based analytics and Looker Studio reporting directly on log entries without duplicating raw log storage or paying separate BigQuery ingestion streaming fees. Ingest Data Access audit logs while actively excluding high-volume, routine read and list operations against Cloud Storage buckets and objects. Which architecture and filter configuration should the security engineer deploy?

Create an organization-level aggregated sink pointing to a user-defined Cloud Logging bucket upgraded for Log Analytics with a linked BigQuery dataset, using the inclusion filter: `log_id("cloudaudit.googleapis.com/data_access") AND NOT protoPayload.methodName =~ "^storage\.(buckets|objects)\.(get|list)$"`: ### What the solution is This solution pairs an **organization-level aggregated log sink** with a specialized **Cloud Logging bucket** upgraded for **Log Analytics**, integrated with BigQuery via a **linked dataset** and tuned with a regular expression filter in the **Logging query language**. ### How it meets all requirements - **Centralized aggregation:** Creating an aggregated sink at the organization root routes matching log records from all child folders and projects into the centralized security monitoring project. - **SQL queries without double storage charges:** Upgrading the destination log bucket to use **Log Analytics** enables standard SQL query capabilities in the Google Cloud console. Creating a **linked BigQuery dataset** allows BigQuery Studio and **Looker Studio** to query the data in place via the BigQuery engine without copying or streaming duplicate rows into standalone BigQuery native storage tables. - **Data Access tuning:** The filter expression isolates Data Access logs (`log_id("cloudaudit.googleapis.com/data_access")`) while using regex matching (`=~`) and negation (`NOT`) to discard high-volume, low-fidelity Cloud Storage object and bucket `get` and `list` methods. ### Key advantages and capabilities - **Cost efficiency:** Eliminates duplicate log ingestion and data streaming charges into BigQuery storage. - **Advanced analytics:** Provides complete BigQuery SQL syntax support, including nested field parsing, aggregations, and joins against reference datasets. - **Precise stream isolation:** The regex pattern `^storage\.(buckets|objects)\.(get|list)$` accurately matches `storage.buckets.get`, `storage.buckets.list`, `storage.objects.get`, and `storage.objects.list` in a single concise evaluation. ### Why this is optimal Using a **Log Analytics** linked dataset fulfills SQL analytics and reporting needs while retaining native Cloud Logging retention and security boundaries, avoiding the maintenance overhead and storage multiplication of traditional multi-destination exports.

Centralized Audit Log Sink Filter Destination | Professional Cloud Security Engineer

Centralized Audit Log Sink Filter Destination

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise wants to implement a centralized log routing and analytical strategy across its Google Cloud organization. The security operations team defines the following requirements:

Aggregate and store Cloud Audit Logs centrally in a dedicated security monitoring project.
Perform SQL-based analytics and Looker Studio reporting directly on log entries without duplicating raw log storage or paying separate BigQuery ingestion streaming fees.
Ingest Data Access audit logs while actively excluding high-volume, routine read and list operations against Cloud Storage buckets and objects.

Which architecture and filter configuration should the security engineer deploy?

Create project-level sinks in every project routing to a central Pub/Sub topic connected to a BigQuery subscription, using the exclusion filter: protoPayload.methodName =~ "storage\.(buckets|objects)\.(get|list)"

Create an organization-level aggregated sink pointing to a user-defined Cloud Logging bucket upgraded for Log Analytics with a linked BigQuery dataset, using the inclusion filter: log_id("cloudaudit.googleapis.com/data_access") AND NOT protoPayload.methodName =~ "^storage\.(buckets|objects)\.(get|list)$"

Create an organization-level aggregated sink pointing to a Cloud Storage bucket destination with Autoclass enabled, using the inclusion filter: log_id("cloudaudit.googleapis.com/data_access") AND NOT protoPayload.methodName = "storage.*"

Create an organization-level aggregated sink with a BigQuery dataset as the direct sink destination, using the inclusion filter: log_id("cloudaudit.googleapis.com/data_access") AND protoPayload.serviceName != "storage.googleapis.com"

Professional Cloud Security Engineer

Centralized Audit Log Sink Filter Destination

Related questions