Professional Security Operations EngineerDemo

Question

You are creating a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You can access Google Threat Intelligence (GTI) data through your Google SecOps subscription.

You need to ensure that the threat-score output in the detection logic affects the alert's risk score and remains available for future detections. What should you do?

A Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
B Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
C Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
D Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.

Explanation

In Google SecOps YARA-L, the outcome section derives values for a triggered detection. Setting the $risk_score outcome variable assigns risk to the resulting alert or detection; the value is stored in the security_result.risk_score UDM field and contributes to entity risk that can be used by subsequent rules. The outcome section is also intended for holding enrichment values for downstream use.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ28

Community Discussion