QuestionQ19
Detection engineeringYour Google Security Operations (SecOps) instance is producing a high volume of alerts for an IP address that recently appeared in a threat-intelligence feed. Multiple vendors flag the IP address as a known command-and-control (C2) server. The IP address is present in repeated DNS queries from a sandboxing system and test environment used by your malware-analysis team. You want to prevent alert fatigue while retaining visibility if the IOC appears again in real production telemetry. What should you do?
- A Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
- B Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
- C Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
- D Add an exception in the detection rule to exclude matches originating from specific asset groups.
Community Discussion