QuestionQ94
Detection engineeringYou are deploying Google Security Operations (SecOps) for your organization. The organization has its own threat-intelligence feed, which was ingested into Google SecOps through a native Malware Information Sharing Platform (MISP) integration. You are developing the following detection rule to use command-and-control (C2) indicators ingested into the entity graph.
What code should you add to the detection rule to filter for domain IOCs?
- A $ioc.graph.metadata.entity_type = "DOMAIN_NAME"$ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
- B $ioc.graph.metadata.entity_type = "DOMAIN_NAME"$ioc.graph.metadata.source_type = "GLOBAL_CONTEXT"
- C $ioc.graph.metadata.entity_type = "DOMAIN_NAME"$ioc.graph.metadata.source_type = "DERIVED_CONTEXT"
- D $ioc.graph.metadata.entity_type = "DOMAIN_NAME"$ioc.graph.metadata.source_type = "SOURCE_TYPE_UNSPECIFIED"
Community Discussion