QuestionQ125

Detection engineering

You are ingesting and parsing logs from an SSO provider and an on-premises appliance with Google Security Operations (SecOps). An internal process marks users as “restricted.” A restriction remains in effect for five days from the latest time the user was flagged.

You need to create a rule that detects restricted users logging in to the appliance. The solution must be fast to implement and simple to maintain. What should you do?

  • A Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
  • B Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
  • C Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
  • D Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
Explanation

Google SecOps can ingest user-flag data as entity context through a feed, with a validity interval representing the five-day restriction period. A multi-event detection rule can join an appliance login UDM event to that user entity context; the Detection Engine evaluates the correlation only when the login timestamp falls within the entity context record’s valid interval. This keeps the rule stable while the feed updates restricted users and their timestamps.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!