PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #112
You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst…
The correct answer is D. Add an action to the playbook that runs the SIEM query and returns the results.. The simplest and most effective way - without writing new code - is to add an action to the playbook that runs the SIEM query and returns the results. This integrates SIEM query results automatically into each phishing case, supporting streamlined analyst investigations.
Question
You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?
Options
- ACreate a custom action in Google SecOps IDE that runs the SIEM query from a playbook through
- BModify the detection rule in the SIEM to include the query results as part of the detection.
- CAdd a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to
- DAdd an action to the playbook that runs the SIEM query and returns the results.
How the community answered
(39 responses)- A15% (6)
- B8% (3)
- C3% (1)
- D74% (29)
Explanation
The simplest and most effective way - without writing new code - is to add an action to the playbook that runs the SIEM query and returns the results. This integrates SIEM query results automatically into each phishing case, supporting streamlined analyst investigations.
Topics
Community Discussion
No community discussion yet for this question.