PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #67
You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce…
The correct answer is C. Navigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise. The correct approach is to navigate to the IOC Matches page and mute the IOCs generated by the red team exercise. Muting these IOCs prevents them from triggering alerts, reducing noise while maintaining visibility into legitimate threats. This method directly targets the source…
Question
You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IOCs that you suspect were generated due to the exercise. What should you do?
Options
- AAsk Gemini to provide a list of IOCs from the red team exercise.
- BFilter IOCs with an ingestion time that matches the time period of the red team exercise.
- CNavigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise.
- DNavigate to the IOC Matches page. Review IOCs with an Indicator Confidence Score (IC-Score)
How the community answered
(47 responses)- A6% (3)
- B15% (7)
- C74% (35)
- D4% (2)
Explanation
The correct approach is to navigate to the IOC Matches page and mute the IOCs generated by the red team exercise. Muting these IOCs prevents them from triggering alerts, reducing noise while maintaining visibility into legitimate threats. This method directly targets the source of alert fatigue without affecting other IOC detections.
Topics
Community Discussion
No community discussion yet for this question.