PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #71
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You…
The correct answer is A. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above. To reduce false positives in YARA-L rules that use Applied Threat Intelligence, you should modify the rules to only trigger on indicators with an IC-Score of 60% or higher. The Indicator Confidence Score (IC-Score) reflects the reliability of each IOC; filtering by a higher…
Question
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?
Options
- AModify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
- BConfigure alert grouping for the most repetitive alerts.
- CImplement curated detections instead of custom YARA-L rules.
- DCreate a playbook that automatically tunes the IOC source if its indicator confidence score (IC-
How the community answered
(25 responses)- A76% (19)
- B4% (1)
- C4% (1)
- D16% (4)
Explanation
To reduce false positives in YARA-L rules that use Applied Threat Intelligence, you should modify the rules to only trigger on indicators with an IC-Score of 60% or higher. The Indicator Confidence Score (IC-Score) reflects the reliability of each IOC; filtering by a higher score reduces noise from low-confidence indicators while maintaining detection of credible threats.
Topics
Community Discussion
No community discussion yet for this question.