Question

After containing a data exfiltration incident, your SOC lead asks you to lead the post-incident review. The incident timeline shows the alert fired at 02:14 but was not acknowledged in the Google SecOps case queue until 09:40, when the day-shift analyst began triage. Containment was completed within 20 minutes of triage starting. Leadership wants the post-incident activity to produce a corrective action that most directly reduces the risk of this delay recurring. Which finding should drive the primary corrective action?

Accepted Answer

The gap between alert creation (02:14) and acknowledgment (09:40) indicates a detection-to-triage handoff gap; implement after-hours alerting/on-call routing and measure mean time to acknowledge (MTTA).

Answer

The mean time to respond (MTTR) once triage began was strong, so no containment playbook changes are needed; document the case and close it.

Answer

The parser that generated the exfiltration event should be rewritten because the alert did not enrich the case with enough context for the overnight shift.

Answer

The YARA-L detection rule should be retuned to raise its severity so that future alerts are noticed faster.