PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #46
You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants…
The correct answer is D. Review the documentation to identify if default parsers exist for the tool, and determine whether E. Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in. Reviewing documentation to confirm whether default parsers exist for the tool ensures logs can be ingested into Google SecOps without heavy customization. Checking the Google SecOps Marketplace verifies whether the tool has native SOAR/SIEM integration and supported actions…
Question
You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool. You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)
Options
- ADevelop a custom integration that uses Python scripts and Cloud Run functions to forward logs
- BConfigure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L
- CReview the architecture of the tool to identify the cloud provider that hosts the tool.
- DReview the documentation to identify if default parsers exist for the tool, and determine whether
- EIdentify the tool in the Google SecOps Marketplace and verify support for the necessary actions in
How the community answered
(31 responses)- A3% (1)
- B16% (5)
- C10% (3)
- D71% (22)
Explanation
Reviewing documentation to confirm whether default parsers exist for the tool ensures logs can be ingested into Google SecOps without heavy customization. Checking the Google SecOps Marketplace verifies whether the tool has native SOAR/SIEM integration and supported actions, which directly impacts how quickly and easily workflows can
Topics
Community Discussion
No community discussion yet for this question.