Minimizing Ingestion Quota for SSH Brute Force Visibility
Short answer
B Ingest Security Command Center Premium findings to identify brute force SSH attempts while minimizing ingestion quota impact.
Question
You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota. Which log type should you ingest into Google SecOps?
Key Takeaways
The question tests the ability to select high-signal, low-volume log sources; the common trap is choosing VPC Flow Logs which generate excessive data without providing authentication context.
To monitor SSH brute force attempts while minimizing ingestion quota usage in Google Security Operations, structured findings from Security Command Center Premium are the optimal choice over raw network or audit logs.
Common mistake: VPC Flow Logs (A) are the most common wrong answer because they capture network traffic but lack application-layer details like login success/failure and consume significant ingestion quotas.
Expert Analysis
Why the Answer Is Correct
Security Command Center Premium (SCCP) provides aggregated security findings, including those related to brute force attacks detected by underlying services. These findings are concise, structured records rather than raw stream logs, allowing you to gain visibility into specific threats with minimal impact on your ingestion quota. By ingesting SCCP findings, you leverage pre-processed intelligence that directly identifies the malicious activity.Why the Other Options Are Wrong
VPC Flow Logs (A) capture network-level metadata (IPs, ports, bytes) but do not contain OS-level session details or authentication results, making them insufficient for verifying SSH login failures. Cloud IDS logs (C) can detect threats but often generate higher volumes of alerts compared to consolidated SCCP findings. Cloud Audit Logs (D) record administrative actions and data access, not application-layer authentication attempts like SSH logins.Community Comment Notes
Community consensus highlights that VPC Flow Logs are incorrect because they are "network-level logs" that lack the necessary application-layer details to verify authentication status, as noted by user SR_RS.Exam Strategy
When asked to minimize ingestion quota, prioritize processed security signals (like SCCP findings) over raw telemetry streams (like VPC Flow Logs or Cloud Logging). Always check if the log source provides the specific context needed (e.g., auth failure vs. just connection attempt).
Frequently Asked Questions
Why are VPC Flow Logs unsuitable for SSH login verification?
They only show network connections, not whether an SSH authentication attempt succeeded or failed.
How does SCCP help reduce ingestion quota usage?
It provides aggregated, structured findings rather than streaming raw logs, significantly lowering volume.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 1
-
SR_RS 👍 1 Answered BA is incorrect because VPC Flow Logs are network-level logs that capture source/destination IPs, ports, and packet counts . They do not contain application-layer or OS-level session details to verify whether an SSH authentication attempt actually succeeded or failed, and they generate massive volumes of logs that would heavily impact your ingestion quota.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.