PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #87
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want
The correct answer is A. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain. To reduce false positives for a rule detecting excessive network connections, you should add a threshold in the YARA-L condition: section. This ensures that the rule triggers only after a specified number of connections, filtering out normal or benign activity while maintaining t
Question
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?
Options
- AAdd a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain
- BAssign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert
- CInclude a 10 minute timeframe for the same source and destination of network connections in the
- DUpdate the YARA-L events: section to exclude the most common IP addresses involved in the
How the community answered
(45 responses)- A71% (32)
- B4% (2)
- C16% (7)
- D9% (4)
Explanation
To reduce false positives for a rule detecting excessive network connections, you should add a threshold in the YARA-L condition: section. This ensures that the rule triggers only after a specified number of connections, filtering out normal or benign activity while maintaining the effectiveness of detecting truly excessive network behavior.
Topics
Community Discussion
No community discussion yet for this question.