nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #67

You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce…

The correct answer is C. Navigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise. The correct approach is to navigate to the IOC Matches page and mute the IOCs generated by the red team exercise. Muting these IOCs prevents them from triggering alerts, reducing noise while maintaining visibility into legitimate threats. This method directly targets the source…

Investigating threats and incidents

Question

You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IOCs that you suspect were generated due to the exercise. What should you do?

Options

  • AAsk Gemini to provide a list of IOCs from the red team exercise.
  • BFilter IOCs with an ingestion time that matches the time period of the red team exercise.
  • CNavigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise.
  • DNavigate to the IOC Matches page. Review IOCs with an Indicator Confidence Score (IC-Score)

How the community answered

(47 responses)
  • A
    6% (3)
  • B
    15% (7)
  • C
    74% (35)
  • D
    4% (2)

Explanation

The correct approach is to navigate to the IOC Matches page and mute the IOCs generated by the red team exercise. Muting these IOCs prevents them from triggering alerts, reducing noise while maintaining visibility into legitimate threats. This method directly targets the source of alert fatigue without affecting other IOC detections.

Topics

#IOC muting#Applied Threat Intelligence#alert fatigue reduction#red team noise filtering

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice