Professional Security Operations Engineer

By Google · Question Mode

QuestionQ6

Incident response

You are collaborating with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst team currently uses a SIEM query to search for related information. You need to design a solution that automatically includes the query results in the Google SecOps case without writing any new code. What should you do?

Explanation

Google SecOps SOAR playbooks can execute built-in integration actions automatically when an alert is ingested. The Google Chronicle integration includes the Execute UDM Query action, which executes a custom UDM query and returns the results, making it suitable for automatically enriching the case without custom development.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!