Professional Security Operations Engineer

By Google · Question Mode

QuestionQ24

Detection engineering

Your Google Security Operations (SecOps) instance is creating alerts for unusual login times across multiple user accounts. SOC analysts report that many of these alerts are false positives associated with service accounts used by scheduled automation tasks. You want to refine the detection logic by using entity-level context available in Google SecOps. What is the most effective action to take?

Explanation

The stem explicitly asks you to leverage entity-level context in Google SecOps, and the most effective, self-maintaining approach is to filter the detection on the user's type so the rule ignores service accounts. Adding a condition such as principal.user.type != "service_account" uses the enriched entity attribute directly and scales automatically as new automation accounts appear. Option A is wrong because asset tags describe machines/assets, not the user (service) accounts generating the logins. Option D (a reference list of every service account, matched on email) is a valid but brittle tuning method that requires constant manual upkeep and is not 'entity-level context', and C (matching email to userid) has nothing to do with distinguishing automation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!