Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ31

Incident response

You are creating a playbook to respond to user phishing reports at your company. You configured a UDM query action to find every user who connected to a malicious domain. You need to extract those users from the UDM query and add them as entities in an alert so that the playbook can reset their passwords. You want to minimize SOC analyst effort. What should you do?

  • A Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
  • B Create a case for each identified user with the user designated as the entity.
  • C Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
  • D Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
Explanation

The Siemplify Create Entity action can automatically add one or more entities to an alert. Using an Expression Builder placeholder in the Entities Identifier parameter extracts the usernames from the UDM query result at runtime, allowing the downstream password-reset automation to act on them without analyst input. Google Security Operations documents that the Expression Builder extracts data from JSON action results for use in playbook actions, and that entity-creation actions add supplied entity identifiers to an alert.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!