You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCS in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?

• A. Implement curated detections instead of custom YARA-L rules.
• B. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
• C. Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC- Score) is between 60% and 80%.
• D. Configure alert grouping for the most repetitive alerts.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
• B. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• C. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• D. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

• A. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
• B. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
• C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
• D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
• B. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
• C. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
• D. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.