nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #87

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want

The correct answer is A. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain. To reduce false positives for a rule detecting excessive network connections, you should add a threshold in the YARA-L condition: section. This ensures that the rule triggers only after a specified number of connections, filtering out normal or benign activity while maintaining t

Detection Engineering and Rule Tuning

Question

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

Options

  • AAdd a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain
  • BAssign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert
  • CInclude a 10 minute timeframe for the same source and destination of network connections in the
  • DUpdate the YARA-L events: section to exclude the most common IP addresses involved in the

How the community answered

(45 responses)
  • A
    71% (32)
  • B
    4% (2)
  • C
    16% (7)
  • D
    9% (4)

Explanation

To reduce false positives for a rule detecting excessive network connections, you should add a threshold in the YARA-L condition: section. This ensures that the rule triggers only after a specified number of connections, filtering out normal or benign activity while maintaining the effectiveness of detecting truly excessive network behavior.

Topics

#YARA-L tuning#threshold configuration#false positive reduction#detection rules

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice