Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ88

Platform operations

You are responsible for assessing the level of effort needed to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Organizational leadership wants to minimize customization for the new tool to enable faster deployment. You need to confirm that Google SecOps SOAR and SIEM support the anticipated workflows for the new third-party tool. You must recommend a tool to your leadership team as quickly as possible. What should you do?

Choose two
  • A Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
  • B Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
  • C Review the architecture of the tool to identify the cloud provider that hosts the tool.
  • D Review' the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
  • E Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
Explanation

Google SecOps SIEM provides supported default parsers that ingest and normalize compatible vendor logs, so confirming that a default parser exists and that the required log format is supported determines whether custom parsing is unnecessary. Google SecOps Marketplace integrations provide supported SOAR actions; verifying that an integration contains the actions required by the workflow determines whether the SOAR use case can be implemented without custom development.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!