Exam Security-Operations-Engineer Topic 1 Question 11 Discussion

Comprehensive and Detailed Explanation
The correct solution is Option B. This question requires a low-latency (5 minutes) notification for a silent source.
The other options are incorrect for two main reasons:
* Dashboards vs. Notifications: Options C and D are incorrect because dashboards (both in Looker and Google SecOps) are for visualization, not active, real-time alerting. They show you the status when you look at them but do not proactively notify you of a failure.
* Metric-Absence vs. Metric-Value: Google SecOps streams all its ingestion health metrics to Google Cloud Monitoring, which is the correct tool for real-time alerting. However, Option A is monitoring the "total ingested log count." This metric would require a threshold (e.g., count < 1), which can be problematic. The specific and most reliable method to detect a "silent source" (one that has stopped sending data entirely) is to use a metric-absence condition. This type of policy in Cloud Monitoring triggers only when the platform stops receiving data for a specific metric (grouped by collector_id) for a defined duration (e.g., five minutes).
Exact Extract from Google Security Operations Documents:
Use Cloud Monitoring for ingestion insights: Google SecOps uses Cloud Monitoring to send the ingestion notifications. Use this feature for ingestion notifications and ingestion volume viewing... You can integrate email notifications into existing workflows.
Set up a sample policy to detect silent Google SecOps collection agents:
* In the Google Cloud console, select Monitoring.
* Click Create Policy.
* Select a metric, such as chronicle.googleapis.com/ingestion/log_count.
* In the Transform data section, set the Time series group by to collector_id.
* Click Next.
* Select Metric absence and do the following:
* Set Alert trigger to Any time series violates.
* Set Trigger absence time to a time (e.g., 5 minutes).
* In the Notifications and name section, select a notification channel.
References:
Google Cloud Documentation: Google Security Operations > Documentation > Ingestion > Use Cloud Monitoring for ingestion insights