Professional Security Operations EngineerDemo

Question

You are a senior SOC analyst in your organization and are receiving alerts for traffic to a command-and-control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with that C2 activity. What should you do?

A Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
B Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
C Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
D Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

Explanation

Google SecOps SIEM Search investigates normalized UDM events and alerts. The grouped ip field spans comparable IP fields—including src.ip and target.ip—so it finds related activity regardless of the IP address’s event role. Enrichment associated with the suspicious events supplies additional investigation context.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ51

Community Discussion