Professional Security Operations Engineer

By Google · Question Mode

QuestionQ25

Data management

You use Google Security Operations (SecOps) curated detections and YARA-L rules to identify suspicious activity on Windows endpoints. Your source telemetry consists of EDR and Windows Event logs, and your rules match the principal.user.userid UDM field. You need to ingest an additional log source so this field can match all possible log entries from your EDR and Windows Event logs. What should you do?

Explanation

Microsoft Sysmon is a supported Google SecOps Windows endpoint/EDR data source, and its default parser maps multiple user fields—including User, ClientInfo, AccountName, and SourceUser—to principal.user.userid. Ingesting Sysmon therefore provides the additional user-ID coverage needed by detections that match this UDM field.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!