Prioritizing IAM Logs for Cloud SIEM Detection

PSOE Last updated Oct 24, 2026

Ingesting logs for security tooling.

Short answer

C Prioritize IAM logs to establish identity context for detecting user behavior, lateral movement, and privilege escalation in a cloud-heavy environment.

Question

You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into: User identity behavior Lateral movement Privilege escalation attempts You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

Cloud access security broker (CASB) logs
EDR logs
IAM logs Correct Answer
Network firewall logs

Key Takeaways

The exam tests the ability to identify the primary data source for identity-centric threats; the trap is selecting EDR because it detects local actions, ignoring that IAM provides the critical identity context required for cloud detection engineering.

This question addresses the prioritization of log ingestion sources in a Google SecOps SIEM deployment, focusing on visibility into user identity, lateral movement, and privilege escalation. The correct approach emphasizes Identity and Access Management (IAM) logs as the foundational telemetry source for cloud-heavy environments.

Common mistake: Candidates often choose EDR logs (B) because they are associated with endpoint security and local privilege escalation, failing to recognize that in a cloud-heavy architecture, identity behavior is the primary vector for tracking lateral movement and access anomalies.

Expert Analysis

Why the Answer Is Correct

In a cloud-heavy enterprise environment, Identity and Access Management (IAM) logs are the most critical telemetry source for understanding user behavior and access patterns. IAM logs capture authentication events, authorization decisions, and administrative actions across cloud resources, providing the necessary context to detect identity-based threats such as compromised accounts used for lateral movement or privilege escalation. Without this identity layer, other logs lack the 'who' dimension essential for effective detection engineering.

Why the Other Options Are Wrong

EDR logs (B) are valuable for monitoring host-level activity but do not provide comprehensive visibility into cloud control plane operations or cross-resource identity relationships. CASB logs (A) focus on SaaS application usage and data loss prevention rather than the fundamental identity lifecycle and access permissions. Network firewall logs (D) show traffic flow but cannot attribute actions to specific users or identities without correlating with IAM data, making them insufficient as a primary source for identity behavior analysis.

Community Comment Notes

Community consensus strongly supports IAM logs as the correct answer. One commenter noted that these requirements 'heavily rely on visibility into who is doing what,' which is the core function of IAM logging. Another emphasized that while EDR tracks local escalation, it 'lacks visibility into the cloud control plane,' reinforcing the need for IAM as the primary ingestion source for cloud-native detection scenarios.

Exam Strategy

When asked about log prioritization in a cloud environment, always look for the source that provides identity context first. If the detection requirements mention 'user behavior', 'access', or 'identity', IAM is almost always the foundational answer before technical logs like EDR or network traffic.

Frequently Asked Questions

Why not EDR logs for privilege escalation?

EDR detects local process creation but lacks the identity context needed to track cross-resource lateral movement and access policy violations in a cloud environment.

Are IAM logs sufficient for lateral movement?

Yes, in cloud contexts, lateral movement is often facilitated by identity abuse (e.g., role assumption), which is directly visible in IAM logs.

More PSOE FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 3

c3tluna 👍 4 Answered C

The detection engineering team's requirements—User identity behavior, Lateral movement, and Privilege escalation attempts—all heavily rely on visibility into who is doing what to which resources. These actions are primarily tracked, controlled, and logged by the Identity and Access Management (IAM) layer in a cloud-heavy enterprise. The log source that provides the most critical and foundational visibility into all three categories in a cloud environment is:
Hamza_hmz123 👍 3

correct ! answer C
b925054 👍 1 Answered C

IAM logs directly capture authentication events, access patterns, source IP locations, and session characteristics for all users interacting with cloud resources. While Endpoint Detection and Response (EDR) is highly valuable for tracking local privilege escalation and lateral movement on traditional endpoints or IaaS Virtual Machines, it lacks visibility into the cloud control plane (SaaS, PaaS, serverless, and cloud management consoles).

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PSOE Study Guide