All Cloud logs are sent to Cloud Logging. Security needs real-time detection and rapid response to anomalies (e.g., unauthorized firewall changes or breaches). Following Google-recommended practices, which export/processing pipeline should you implement?

Exporting logs to a Pub/Sub topic and invoking a Cloud Function is the recommended approach for real-time detection and rapid response. Cloud Logging can export logs directly to Pub/Sub. Pub/Sub provides a low-latency, highly scalable messaging service that delivers log entries to subscribers. A Cloud Function can then be triggered by new messages in the Pub/Sub topic, allowing for immediate processing and alerting on anomalies. Using Cloud Scheduler with a cron job to query Cloud Logging introduces latency, as it only runs periodically. Exporting to BigQuery and running scheduled queries also introduces latency and is better suited for analytical purposes than real-time detection. Exporting to Cloud Storage and triggering Cloud Run would also introduce latency as Cloud Storage is not designed for real-time event streaming and Cloud Run would need to be invoked, adding overhead.