PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #120
Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be…
The correct answer is A. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook. In Google SecOps, playbook triggers are evaluated by priority. By assigning a higher numerical priority (which means lower precedence) to the "All" playbook, you ensure that…
Question
Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match. What should you do?
Options
- ASet the priority of the "All" playbook to a higher value than the priority of the specific playbook to
- BChange the "All" trigger to be more precise so that it doesn't trigger when the other playbook is
- CIn the Outcomes section of the detection rule that is firing your alert, add a specific field to search
- DCreate a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the
How the community answered
(16 responses)- A81% (13)
- B6% (1)
- C13% (2)
Explanation
Set the priority of the "All" playbook to a higher value than the priority of the specific playbook. In Google SecOps, playbook triggers are evaluated by priority. By assigning a higher numerical priority (which means lower precedence) to the "All" playbook, you ensure that more specific playbooks with lower numerical priorities (higher precedence) will be attached and executed first when multiple triggers match, and the generic "All" playbook will only be used if no specific playbook applies.
Topics
Community Discussion
No community discussion yet for this question.