QuestionQ125
Detection engineeringYou are ingesting and parsing logs from an SSO provider and an on-premises appliance with Google Security Operations (SecOps). An internal process marks users as “restricted.” A restriction remains in effect for five days from the latest time the user was flagged.
You need to create a rule that detects restricted users logging in to the appliance. The solution must be fast to implement and simple to maintain. What should you do?
- A Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
- B Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
- C Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
- D Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
Community Discussion