You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps…

The correct answer is D. Select the entity identifier in the Entity Highlights widget to open Entity Explorer. The most efficient method is to select the entity identifier in the Entity Highlights widget to open Entity Explorer. Entity Explorer consolidates enrichment attributes, historical cases, and contextual relationships in one place, allowing you to quickly view past activity and…

Investigating Threats

Question

You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?

Options

AInitiate a SIEM Search to query the entity.
BInitiate a SOAR Search to query the entity.
CSelect View Details for the entity in the Entity Highlights widget.
DSelect the entity identifier in the Entity Highlights widget to open Entity Explorer.

How the community answered

(32 responses)

A
16% (5)
B
3% (1)
C
9% (3)
D
72% (23)

Explanation

The most efficient method is to select the entity identifier in the Entity Highlights widget to open Entity Explorer. Entity Explorer consolidates enrichment attributes, historical cases, and contextual relationships in one place, allowing you to quickly view past activity and investigations with minimal steps.

Topics

#Entity Explorer#entity enrichment#historical cases#investigation workflow

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice