Comprehensive and Detailed Explanation
The correct solution is Option B. This question requires a low-latency (5 minutes) notification for a silent source.
The other options are incorrect for two main reasons:
Dashboards vs. Notifications: Options C and D are incorrect because dashboards (both in Looker and Google SecOps) are for visualization, not active, real-time alerting. They show you the status when you look at them but do not proactively notify you of a failure.
Metric-Absence vs. Metric-Value: Google SecOps streams all its ingestion health metrics to Google Cloud Monitoring, which is the correct tool for real-time alerting. However, Option A is monitoring the "total ingested log count." This metric would require a threshold (e.g., count < 1), which can be problematic. The specific and most reliable method to detect a "silent source" (one that has stopped sending data entirely) is to use a metric-absence condition. This type of policy in Cloud Monitoring triggers only when the platform stops receiving data for a specific metric (grouped by collector_id) for a defined duration (e.g., five minutes).
Exact Extract from Google Security Operations Documents:
Use Cloud Monitoring for ingestion insights: Google SecOps uses Cloud Monitoring to send the ingestion notifications. Use this feature for ingestion notifications and ingestion volume viewing... You can integrate email notifications into existing workflows.
Set up a sample policy to detect silent Google SecOps collection agents:
In the Google Cloud console, select Monitoring.
Click Create Policy.
Select a metric, such as chronicle.googleapis.com/ingestion/log_count.
In the Transform data section, set the Time series group by to collector_id.
Click Next.
Select Metric absence and do the following:
Set Alert trigger to Any time series violates.
Set Trigger absence time to a time (e.g., 5 minutes).
In the Notifications and name section, select a notification channel.
[References:, Google Cloud Documentation: Google Security Operations > Documentation > Ingestion > Use Cloud Monitoring for ingestion insights, , ]
