Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ121

Platform operations

Your company’s analyst team uses a playbook to make required changes to external systems integrated with the Google Security Operations (SecOps) platform. You must automate this task so that it runs once each day at a specified time. You want the solution to minimize maintenance overhead. What should you do?

  • A Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
  • B Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
  • C Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
  • D Use a VM to host a script that runs a playbook via an API call.
Explanation

Google SecOps SOAR includes a Cron Scheduled Connector that triggers playbooks for a specified alert product, name, and type and supports cron expressions. Configuring the connector and a playbook trigger for its created cases reuses the existing playbook automation without requiring custom code or an externally managed VM.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!