Professional Security Operations Engineer

The built-in Security Health Analytics PUBLIC_IP_ADDRESS detector generates a finding when a Compute Engine instance has a public IP address. The affected instances can be checked for the compliance=pci tag so that monitoring and alerting apply to the required subset without creating a redundant custom detector.

Cortex XSOAR playbooks automate security workflows, and conditional tasks direct the workflow based on field values or parameters. A conditional branch can check the escalation status, send the director an email containing the relevant notes for escalated cases, and close cases without that email when they were not escalated. This makes notification part of the controlled closure workflow.

Bindplane agents collect and send on-premises telemetry, including Syslog, to Google SecOps. A namespace identifies assets from separate network environments and deconflicts overlapping IP addresses; ingestion labels instead provide metadata for identifying or filtering log streams.

A UDM search limited to the DNS portion of the network event data directly examines normalized DNS telemetry for the domain, avoiding the unnecessary breadth of a raw-log string search. Google SecOps supports searches over normalized UDM events and provides domain-focused investigation capabilities for determining whether a domain is present in enterprise data.

Google SecOps SOAR provides a Google Security Command Center Marketplace integration and a Findings connector for retrieving SCC findings and using them in SOAR alerts and actions. The supported integration requires appropriate IAM-authorized service-account or Workload Identity access to SCC. Pub/Sub notification configurations are not the primary SOAR Marketplace-connector configuration described for pulling findings into SOAR.