Professional Security Operations EngineerDemo

Question

You have observed that a Google Security Operations (SecOps) detection rule for excessive network connections is firing too often and generating too many false-positive alerts. You want to refine the rule to reduce this noise without decreasing the rule's effectiveness. What change should you make to the detection rule?

A Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
B Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
C Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
D Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

Explanation

In a YARA-L detection rule, the condition section controls whether an alert triggers. Adding a count threshold requires a sufficient number of network-connection events before a detection is generated, reducing alerts from normal or isolated activity while continuing to detect excessive connection volumes. A match time window only groups events; it does not by itself impose a volume threshold. Risk scores prioritize detections rather than suppressing them, and excluding frequently seen IP addresses can hide malicious activity.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ42

Community Discussion