Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ24

Detection engineering

Your Google Security Operations (SecOps) instance is creating alerts for unusual login times across multiple user accounts. SOC analysts report that many of these alerts are false positives associated with service accounts used by scheduled automation tasks. You want to refine the detection logic by using entity-level context available in Google SecOps. What is the most effective action to take?

  • A Use asset tags to group known automation systems, and exclude them from the alert logic.
  • B Modify the rule to include the principal.user.type != "service_account" condition.
  • C Update the rule to only alert when the principal.user.email and principal.user.userid fields match in the same event.
  • D Add a reference list of all service accounts, and suppress alerts for any matches on the principal.user.email field.
Explanation

The stem explicitly asks you to leverage entity-level context in Google SecOps, and the most effective, self-maintaining approach is to filter the detection on the user's type so the rule ignores service accounts. Adding a condition such as principal.user.type != "service_account" uses the enriched entity attribute directly and scales automatically as new automation accounts appear. Option A is wrong because asset tags describe machines/assets, not the user (service) accounts generating the logins. Option D (a reference list of every service account, matched on email) is a valid but brittle tuning method that requires constant manual upkeep and is not 'entity-level context', and C (matching email to userid) has nothing to do with distinguishing automation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!