PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #111
You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate…
The correct answer is C. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and. The most effective method is to conduct a Google SecOps SIEM Search using src.ip and target.ip to identify both outbound and inbound traffic associated with the C2 IP address. This approach gives you comprehensive visibility into all interactions with the suspicious IP, supportin
Question
You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?
Options
- AUse Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP
- BUse Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
- CConduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and
- DUse Google SecOps SIEM Search to query against the grouped ip field, and use the enriched
How the community answered
(29 responses)- A7% (2)
- B3% (1)
- C79% (23)
- D10% (3)
Explanation
The most effective method is to conduct a Google SecOps SIEM Search using src.ip and target.ip to identify both outbound and inbound traffic associated with the C2 IP address. This approach gives you comprehensive visibility into all interactions with the suspicious IP, supporting a thorough investigation.
Topics
Community Discussion
No community discussion yet for this question.