Question

After closing a phishing-driven credential-theft incident in Google SecOps, the post-incident review finds that the initial malicious OAuth token grant went undetected for 6 days because no rule existed to flag high-privilege third-party app authorizations. The SOC lead wants the review to produce the most durable improvement to prevent a repeat blind spot. Which post-incident action best closes the loop between the RCA finding and future detection coverage?

Accepted Answer

Author and deploy a new YARA-L detection rule for anomalous high-privilege OAuth grants, add it to the detection backlog with an assigned owner, and validate it against the incident's historical data before promotion

Answer

Add the specific malicious application client ID from this incident to a blocklist reference list so the exact app cannot be re-authorized

Answer

Increase the case priority scoring for all future OAuth-related alerts so analysts triage them faster

Answer

Document the 6-day detection delay in the incident timeline and record MTTD as a lessons-learned metric for the quarterly report