Professional Security Operations Engineer

By Google · Question Mode

QuestionQ21

Threat hunting

You are a SOC analyst investigating a case in Google Security Operations (SecOps). The case includes a file hash that playbooks have automatically enriched with VirusTotal context and classified as likely malicious. You need to rapidly identify the devices and users in your organization that have interacted with this file. What should you do?

Explanation

A Google SecOps SIEM UDM search can query normalized security telemetry for a file hash and surface the associated events, devices, and users. Running that search as a Google SecOps SOAR manual action supports an immediate, case-specific investigation; a TIP lookup supplies intelligence about the indicator rather than identifying internal interactions with it.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!