Chronicle Pubsub Push Log Export Pipeline

What Google Cloud Pub/Sub Push to Google SecOps is

Google SecOps (Chronicle) provides native Feeds functionality that allows ingestion of telemetry directly from Google Cloud services. Combining Cloud Logging log sinks, Cloud Pub/Sub, and Google SecOps Feeds establishes a fully managed, serverless, and secure real-time streaming pipeline.

How it meets the requirements

• Real-time telemetry streaming: Cloud Logging sinks stream log entries into Cloud Pub/Sub topics in near real-time (with 99% of log entries delivered in under 60 seconds).
• Delivery reliability and buffering: Pub/Sub acts as a resilient buffer that handles bursts in log volume and manages retries automatically.
• Minimal operational overhead: Using a native Google Cloud Pub/Sub Push feed eliminates the need to deploy and maintain custom forwarders or worker VMs.
• Strict authentication: Setting up a Pub/Sub push subscription pointing to the SecOps feed HTTPS endpoint with Enable authentication selected ensures that every HTTP POST request carries a signed OpenID Connect (OIDC) identity token from an authorized service account.

Key advantages and capabilities

• Native OCSF and log format support: Feeds can be configured directly with standard schemas (such as OCSF) and custom split delimiters.
• Centralized aggregation: Organization-level or folder-level aggregated log sinks capture telemetry across all child projects and route them to a single centralized topic.
• Zero infrastructure maintenance: Eliminates the burden of patching, autoscaling, or managing collector virtual machines.

Why this is optimal

This approach leverages native platform integration and built-in IAM service account token validation, ensuring maximum throughput, minimal latency, and robust transport-layer authentication without additional middleware.