How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

The most reliable and scalable method to deliver logs from across a GCP organization to an on-premises SIEM is to use an aggregated export sink. An organization-level log sink captures logs from all projects and folders. Exporting to a Cloud Pub/Sub topic provides a durable, real-time, and scalable buffer. A downstream process, such as a Dataflow job or a custom subscriber, can then pull messages from the Pub/Sub subscription and reliably forward them to the on-premises SIEM, handling retries and backpressure automatically.

A. Using syslog is not a managed or scalable GCP-native solution and would not capture all cloud service logs (e.g., audit logs).
B. Having the SIEM query BigQuery is a pull-based model that is not real-time and can be inefficient for continuous log streaming.
D. Directly querying the GCP logging APIs from an on-premises system is not scalable, is subject to API rate limits, and is not a reliable streaming solution.

1. Google Cloud Documentation, "Overview of log exports". The document states: "To export logs to third-party destinations, you can route your logs to Pub/Sub... Once your logs are in Pub/Sub, you can integrate with third parties".

2. Google Cloud Documentation, "Scenarios for exporting Cloud Logging: SIEM". This page explicitly details the recommended architecture: "Export to Pub/Sub and use a pull subscriber to deliver messages to your SIEM... This is the most common way to export logs from Logging." It also provides a diagram showing Log Sink -> Pub/Sub -> SIEM.

3. Google Cloud Architecture Center, "Logging export for security and access analytics". This guide recommends creating an aggregated sink at the organization level that exports to Pub/Sub for consumption by external systems like a SIEM.