Professional Security Operations EngineerDemo

Question

You are an incident-response engineer at an organization that uses Google Security Operations (SecOps). You recently began monitoring IOCs in Applied Threat Intelligence with YARA-L rules. You have found more false-positive alerts than expected, creating noise for the SOC team. You need to lower the number of false-positive alerts. What should you do?

A Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
B Configure alert grouping for the most repetitive alerts.
C Implement curated detections instead of custom YARA-L rules.
D Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC-Score) is between 60% and 80%.

Explanation

An indicator-confidence threshold in a YARA-L IOC-matching rule restricts detections to indicators with sufficient assessed maliciousness confidence, excluding lower-confidence indicators that are more likely to create noisy matches. Google SecOps supports extracting an indicator confidence score from Applied Threat Intelligence context and using it in rule condition logic.

Learn more

Applied Threat Intelligence Fusion Feed

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ18

Community Discussion