Question

A SecOps analyst is triaging the morning queue in Google SecOps. Three separate alerts have opened as distinct cases within a 15-minute window: (1) a suspicious PowerShell execution on host WIN-APP-04, (2) an outbound connection from WIN-APP-04 to a domain flagged by GTI as C2 infrastructure, and (3) a rare scheduled task creation on WIN-APP-04. The analyst confirms all three reference the same host entity, the same user principal, and overlapping timestamps consistent with a single intrusion chain. What is the MOST appropriate triage action before beginning containment?

Accepted Answer

Consolidate the three cases into a single case so the full attack narrative and combined severity are investigated and tracked together

Answer

Close cases 1 and 3 as duplicates of case 2 since the GTI C2 match is the highest-fidelity signal

Answer

Work each case independently to preserve separate audit trails and assign them to three different analysts for parallel speed

Answer

Suppress the underlying detection rules for cases 1 and 3 to stop further duplicate alerts before investigating