QuestionQ6
Incident responseYou are collaborating with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst team currently uses a SIEM query to search for related information. You need to design a solution that automatically includes the query results in the Google SecOps case without writing any new code. What should you do?
- A Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
- B Modify the detection rule in the SIEM to include the query results as part of the detection.
- C Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
- D Add an action to the playbook that runs the SIEM query and returns the results.
Community Discussion