Security-Operations-Engineer Exam Dumps | You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google

<< Prev Question Next Question >>

Question 44/63

You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?

A. Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.

B. Create a reference list that contains the AD context data. Use the reference list in your YARA-L rule to find user/asset information for each security event.

C. Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.

D. Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.

Question 44/63

LEAVE A REPLY

Download PDF File