Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ21

Threat hunting

You are a SOC analyst investigating a case in Google Security Operations (SecOps). The case includes a file hash that playbooks have automatically enriched with VirusTotal context and classified as likely malicious. You need to rapidly identify the devices and users in your organization that have interacted with this file. What should you do?

  • A Build a playbook to perform a UDM search matching on the file hash in Google SecOps SIEM.
  • B Build a playbook to query your threat intelligence platform (TIP) for the presence of the file hash.
  • C Use a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.
  • D Use a manual action in Google SecOps SOAR to query your threat intelligence platform (TIP) for the presence of the file hash.
Explanation

A Google SecOps SIEM UDM search can query normalized security telemetry for a file hash and surface the associated events, devices, and users. Running that search as a Google SecOps SOAR manual action supports an immediate, case-specific investigation; a TIP lookup supplies intelligence about the indicator rather than identifying internal interactions with it.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!