PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #126
You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and…
The correct answer is A. Develop the rule logic in the UDM search, review the search output to inform changes to filters. The safest way to minimize production impact is to develop and refine the rule logic in UDM search first. By running searches and reviewing outputs, you can iteratively tune filters and conditions until the detections are accurate. Once validated, you then copy the tested query…
Question
You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?
Options
- ADevelop the rule logic in the UDM search, review the search output to inform changes to filters
- BUse Gemini in Google SecOps to develop the rule by providing a description of the parameters
- CDevelop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the
- DDevelop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by
How the community answered
(41 responses)- A76% (31)
- B15% (6)
- C2% (1)
- D7% (3)
Explanation
The safest way to minimize production impact is to develop and refine the rule logic in UDM search first. By running searches and reviewing outputs, you can iteratively tune filters and conditions until the detections are accurate. Once validated, you then copy the tested query into the Rules Editor. This approach ensures accuracy without risking false positives or unnecessary load in production.
Topics
Community Discussion
No community discussion yet for this question.