An enterprise has deployed Cloud Next-Generation Firewall (Cloud NGFW) Enterprise with Intrusion Prevention Service (IPS) profiles and TLS inspection to secure sensitive workloads within a VPC network. The Security Operations Center (SOC) is investigating suspicious outbound Layer 7 application traffic suspected of being command-and-control (C2) communication. The security team must: Verify whether Cloud NGFW detected the threat signature and whether the policy actively blocked or merely alerted on the traffic. Identify the Layer 7 application name, threat ID, and threat severity directly from the log records. Stream high-severity threat events in real time to the enterprise SIEM for automated incident triage without losing critical security signals. Which logging analysis and integration strategy should the security engineer implement?

Query Cloud NGFW threat logs in Cloud Logging to evaluate `threat_id`, `application_name`, and `action` in the `jsonPayload`, and configure a filtered Log Router sink streaming to a Pub/Sub topic connected to the SIEM.: What Cloud NGFW Threat Logging and Log Router Are Cloud NGFW Enterprise integrates Layer 7 application inspection (AppID) and Intrusion Prevention Service (IPS) powered by security signatures. When IPS endpoints inspect decrypted network sessions, deep-packet inspection logs are generated and written to Cloud Logging under the Cloud NGFW resource type, recording detailed application-layer metadata and security enforcement actions. How It Meets the Requirements Validating Policy Effectiveness: Cloud NGFW logs capture the exact enforcement outcome in the jsonPayload.action field (such as ALERT, DENY, or DROP), confirming whether the security profile blocked the exploit or operated in detection-only mode. Extracting Layer 7 Application and Threat Context: The structured jsonPayload contains dedicated fields including threat_id, threat_category, threat_severity, and application_name (or app_id), providing immediate visibility into evasive Layer 7 protocols. Real-Time SIEM Integration: Creating a Cloud Logging sink (Log Router) with an inclusion filter for high-severity threat logs routes events directly to a Pub/Sub topic, enabling real-time, low-latency ingestion into enterprise SIEM and SOAR systems without dropping critical signals. Key Advantages and Capabilities Native Layer 7 Metadata: Decodes application protocols beyond port/IP tuples, even across non-standard ports. High-Fidelity Telemetry: Captures full threat metadata (CVE references, signature IDs, and directionality). Decoupled Event Streaming: Pub/Sub provides scalable, fault-tolerant message buffering for incident response workflows. Selective Log Routing: Filter expressions ensure only relevant security events are forwarded, controlling ingestion and storage costs. Why This Is Optimal Cloud NGFW threat logs uniquely deliver inline Layer 7 and IPS signature metadata. Streaming these structured events via Log Router sinks to Pub/Sub is Google Cloud's recommended architecture for event-driven SecOps integration.