nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #78

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the…

The correct answer is B. Use the number of detections from the response JSON in a conditional statement to set the E. Use a conditional statement to determine whether to treat the URL as suspicious or benign. Use the number of detections returned in the VirusTotal JSON response in a conditional statement to programmatically determine the severity of the alert. This quantifies the threat level based on multiple vendor detections. Implement a conditional statement to classify the URL…

Security Orchestration Automation and Response

Question

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

Options

  • ACreate a widget that translates the JSON output to a severity score.
  • BUse the number of detections from the response JSON in a conditional statement to set the
  • CVerify that the response is accurate by manually checking the URL in VirusTotal
  • DPass the response back to the SIEM.
  • EUse a conditional statement to determine whether to treat the URL as suspicious or benign.

How the community answered

(53 responses)
  • A
    15% (8)
  • B
    74% (39)
  • C
    4% (2)
  • D
    8% (4)

Explanation

Use the number of detections returned in the VirusTotal JSON response in a conditional statement to programmatically determine the severity of the alert. This quantifies the threat level based on multiple vendor detections. Implement a conditional statement to classify the URL as suspicious or benign based on the VirusTotal results. This enables the playbook to provide a preliminary recommendation and guide subsequent analyst actions.

Topics

#VirusTotal integration#SOAR playbook#URL enrichment#conditional logic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice