An enterprise has deployed Cloud Next-Generation Firewall (Cloud NGFW) Enterprise with Intrusion Prevention Service (IPS) profiles and TLS inspection to secure sensitive workloads within a VPC network. The Security Operations Center (SOC) is investigating suspicious outbound Layer 7 application traffic suspected of being command-and-control (C2) communication. The security team must: Verify whether Cloud NGFW detected the threat signature and whether the policy actively blocked or merely alerted on the traffic. Identify the Layer 7 application name, threat ID, and threat severity directly from the log records. Stream high-severity threat events in real time to the enterprise SIEM for automated incident triage without losing critical security signals. Which logging analysis and integration strategy should the security engineer implement?

Query Cloud NGFW threat logs in Cloud Logging to evaluate `threat_id`, `application_name`, and `action` in the `jsonPayload`, and configure a filtered Log Router sink streaming to a Pub/Sub topic connected to the SIEM.: ### What Cloud NGFW Threat Logging and Log Router Are **Cloud NGFW Enterprise** integrates Layer 7 application inspection (AppID) and **Intrusion Prevention Service (IPS)** powered by security signatures. When IPS endpoints inspect decrypted network sessions, deep-packet inspection logs are generated and written to **Cloud Logging** under the Cloud NGFW resource type, recording detailed application-layer metadata and security enforcement actions. ### How It Meets the Requirements - **Validating Policy Effectiveness:** Cloud NGFW logs capture the exact enforcement outcome in the `jsonPayload.action` field (such as `ALERT`, `DENY`, or `DROP`), confirming whether the security profile blocked the exploit or operated in detection-only mode. - **Extracting Layer 7 Application and Threat Context:** The structured `jsonPayload` contains dedicated fields including `threat_id`, `threat_category`, `threat_severity`, and `application_name` (or `app_id`), providing immediate visibility into evasive Layer 7 protocols. - **Real-Time SIEM Integration:** Creating a **Cloud Logging sink** (Log Router) with an inclusion filter for high-severity threat logs routes events directly to a **Pub/Sub topic**, enabling real-time, low-latency ingestion into enterprise SIEM and SOAR systems without dropping critical signals. ### Key Advantages and Capabilities - **Native Layer 7 Metadata:** Decodes application protocols beyond port/IP tuples, even across non-standard ports. - **High-Fidelity Telemetry:** Captures full threat metadata (CVE references, signature IDs, and directionality). - **Decoupled Event Streaming:** Pub/Sub provides scalable, fault-tolerant message buffering for incident response workflows. - **Selective Log Routing:** Filter expressions ensure only relevant security events are forwarded, controlling ingestion and storage costs. ### Why This Is Optimal Cloud NGFW threat logs uniquely deliver inline Layer 7 and IPS signature metadata. Streaming these structured events via Log Router sinks to Pub/Sub is Google Cloud's recommended architecture for event-driven SecOps integration.

Cloud Ngfw Threat Logs Analysis Siem Integration | Professional Cloud Security Engineer

Cloud Ngfw Threat Logs Analysis Siem Integration

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise has deployed Cloud Next-Generation Firewall (Cloud NGFW) Enterprise with Intrusion Prevention Service (IPS) profiles and TLS inspection to secure sensitive workloads within a VPC network. The Security Operations Center (SOC) is investigating suspicious outbound Layer 7 application traffic suspected of being command-and-control (C2) communication.

The security team must:

Verify whether Cloud NGFW detected the threat signature and whether the policy actively blocked or merely alerted on the traffic.
Identify the Layer 7 application name, threat ID, and threat severity directly from the log records.
Stream high-severity threat events in real time to the enterprise SIEM for automated incident triage without losing critical security signals.

Which logging analysis and integration strategy should the security engineer implement?

Query Cloud NGFW threat logs in Cloud Logging to evaluate threat_id, application_name, and action in the jsonPayload, and configure a filtered Log Router sink streaming to a Pub/Sub topic connected to the SIEM.

Query Cloud NAT logging to extract threat signature payloads, and schedule a daily Cloud Storage Transfer Service job to push the logs to the SIEM.

Inspect Cloud Armor security policy logs on the internal backend services, check enforcedSecurityPolicy attributes, and run BigQuery scheduled queries to notify the SIEM.

Enable VPC Flow Logs on all subnetworks, filter for TCP connection reset flags in Cloud Monitoring, and use Cloud Functions to trigger hourly webhook alerts to the external SIEM.

Professional Cloud Security Engineer

Cloud Ngfw Threat Logs Analysis Siem Integration

Related questions