I am planning to ingest Zoom operation and activity logs into Google SecOps (Chronicle) and would like your insights on the most efficient way to achieve this.

My proposed approach involves using Cloud Functions in conjunction with Google Cloud Scheduler to run jobs that will fetch the logs from Zoom API endpoints. However, I am uncertain about the optimal receiving point. Here are the options I’m considering:

• Pub/Sub: I could create a topic and establish a direct feed from Chronicle to that topic. The Cloud Function would publish the fetched logs to this topic.

• Cloud Storage: The Cloud Function would dump all the logs into a bucket, and Chronicle would fetch them using a direct feed from the bucket.

• Log Ingestion API: The Cloud Function would post the logs directly to Chronicle using the available log ingestion API.

Which solution do you think is the most efficient?