Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ74

Detection engineering

Your company uses Google Security Operations (SecOps) Enterprise and ingests a variety of logs. You need to proactively find potentially compromised user accounts. In particular, you must detect when a user account downloads an unusually large amount of data relative to that user's established baseline activity. You want to identify this anomalous data-access behavior with the least effort. What should you do?

  • A Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
  • B Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
  • C Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.
  • D Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.
Explanation

Google SecOps UEBA and Risk Analytics are designed to identify unusual behavior and entity risk using behavioral analytics rather than a manually maintained fixed threshold. Risk Analytics specifically supports investigating user entities and documents high download volume as a use case, where entities with high download volumes receive elevated risk scores. Curated UEBA detections therefore provide the lowest-effort way to surface users whose download activity deviates from normal behavior.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!