Question

A SOC manager wants to reduce analyst pivot time during triage. Analysts currently review Google SecOps alerts, then manually copy suspicious hashes and domains into the Google Threat Intelligence (GTI) web portal to check reputation and associations. The manager asks you to redesign the integration so that reputation context appears directly within the SecOps investigation workflow, while keeping GTI's deeper attribution and malware-family reporting available for escalations. Which approach best satisfies both requirements?

Accepted Answer

Configure the GTI integration in SecOps to automatically enrich UDM entities (hashes, domains, IPs) with threat context, and retain GTI portal access for deep-dive attribution during escalations.

Answer

Export all GTI IOC feeds into a SecOps reference list nightly and deprecate the GTI portal, since reference-list matching provides equivalent context.

Answer

Have analysts continue using the GTI portal manually but grant them the SecOps Editor role so they can annotate alerts faster.

Answer

Forward SecOps alerts to the GTI portal via webhook so that all triage occurs inside GTI rather than SecOps.