nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #103

You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integ

The correct answer is A. $ioc.graph.metadata.entity_type = "DOMAIN_NAME". This code ensures your rule matches IOCs classified as domain names and sourced directly as entity context from MISP, allowing precise correlation between DNS queries and known C2

Detection Engineering

Question

You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integration with a Malware Information Sharing Platform (MISP). You are working on the following detection rule to leverage the command and control (C2) indicators that were ingested into the entity graph. What code should you add in the detection rule to filter for the domain IOCs?

Exhibit

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER question #103 exhibit

Options

  • A$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  • B$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  • C$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  • D$ioc.graph.metadata.entity_type = "DOMAIN_NAME"

How the community answered

(28 responses)
  • A
    79% (22)
  • B
    14% (4)
  • C
    4% (1)
  • D
    4% (1)

Explanation

This code ensures your rule matches IOCs classified as domain names and sourced directly as entity context from MISP, allowing precise correlation between DNS queries and known C2

Topics

#YARA-L rules#entity graph#MISP integration#domain IOC filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice