Google GCP-SOE-B Value Pack (Frequently Bought Together)

You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

• A. Run raw log searches using the IP address as a search term.
• B. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
• C. Write a YARA-L 2.0 detection rule that searches for events with the IP address.
• D. On the Alerts & IOCS page, review results and entries where the IP address appears.

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

• A. Use a custom parser that outputs all fields as raw JSON for detection.
• B. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
• C. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
• D. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Generate a report in SOAR Reports, and schedule delivery of the report.
• B. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• C. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
• D. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCS and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
• B. Create a Security Health Analytics (SHA) custom module using the compute address resource.
• C. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
• D. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• B. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
• C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• D. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.