PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #57
You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions…
The correct answer is C. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to. The best solution is to ingest the user flags as custom enrichment data using a feed and then use a multi-event detection rule to detect logins from users flagged in the entity graph. This approach is quick to implement, integrates cleanly with Google SecOps, and ensures that…
Question
You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted” by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?
Options
- AUse a Google SecOps SOAR global context value to store a list of flagged users with their
- BStore the identifiers of the flagged users in the detection rule logic. Actively monitor for newly
- CIngest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to
- DStore the flagged users in a data table column with their corresponding time to live values in a
How the community answered
(61 responses)- A13% (8)
- B5% (3)
- C79% (48)
- D3% (2)
Explanation
The best solution is to ingest the user flags as custom enrichment data using a feed and then use a multi-event detection rule to detect logins from users flagged in the entity graph. This approach is quick to implement, integrates cleanly with Google SecOps, and ensures that restricted user flags are dynamically correlated without constant manual updates or complex rule rebuilding.
Topics
Community Discussion
No community discussion yet for this question.