PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #17
You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active…
The correct answer is D. Ingest AD organizational context data as user/asset context to enrich user/asset information in. The best approach is to ingest AD organizational context data directly into Google SecOps as user/asset context. This ensures that AD user and asset information is automatically enriched in security events without manual exports or watchlists. It improves correlation…
Question
You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?
Options
- AConfigure a Google SecOps SOAR integration for AD to enrich user/asset information in your
- BCreate a reference list that contains the AD context data. Use the reference list in your YARA-L
- CCreate a data table that contains AD context data. Use the data table in your YARA-L rule to find
- DIngest AD organizational context data as user/asset context to enrich user/asset information in
How the community answered
(53 responses)- A8% (4)
- B17% (9)
- C4% (2)
- D72% (38)
Explanation
The best approach is to ingest AD organizational context data directly into Google SecOps as user/asset context. This ensures that AD user and asset information is automatically enriched in security events without manual exports or watchlists. It improves correlation, investigation efficiency, and automation compared to maintaining separate reference lists or data tables.
Topics
Community Discussion
No community discussion yet for this question.