QuestionQ120
Detection engineeringA Google Security Operations (SecOps) detection rule is producing frequent false-positive alerts. The rule was created to detect suspicious Cloud Storage enumeration by alerting whenever the storage.objects.list API operation is invoked through the api.operation UDM field. However, a legitimate backup automation tool uses the same API, which causes the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while continuing to detect potentially malicious use. How should you change the rule to improve its accuracy?
- A Add principal.user.email != "[email protected]" to the rule condition to exclude the automation account.
- B Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
- C Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
- D Adjust the rule severity to LOW to deprioritize alerts from automation tools.
Community Discussion