nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #70

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules…

The correct answer is A. Ingest logs from Windows Sysmon. To ensure the principal.user.userid field captures all relevant activity, you should ingest logs from Windows Sysmon. Sysmon provides detailed system activity, including process creation, network connections, and user context, which complements EDR and Windows Event logs…

Managing data ingestion and parsing

Question

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

Options

  • AIngest logs from Windows Sysmon.
  • BIngest logs from Microsoft Entra ID.
  • CIngest logs from Windows PowerShell.
  • DIngest logs from Windows Procmon.

How the community answered

(28 responses)
  • A
    75% (21)
  • B
    7% (2)
  • C
    4% (1)
  • D
    14% (4)

Explanation

To ensure the principal.user.userid field captures all relevant activity, you should ingest logs from Windows Sysmon. Sysmon provides detailed system activity, including process creation, network connections, and user context, which complements EDR and Windows Event logs, allowing YARA-L rules to match across all endpoint telemetry.

Topics

#Windows Sysmon#UDM field coverage#principal.user.userid#log source selection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice