Question

After containing a compromised GKE workload, your team must reconstruct the attacker's activity timeline for the post-incident report. During the incident, an analyst manually terminated the malicious pod before capturing forensic artifacts, and the SOAR playbook's evidence-collection step was skipped due to a connector timeout. You need to determine the earliest reliable point of initial access. Which approach provides the most defensible timeline reconstruction given the missing artifacts?

Accepted Answer

Correlate ingested UDM events in Google SecOps (audit logs, network flows, and process telemetry) across the incident window, using event timestamps to establish the sequence independent of the lost pod artifacts

Answer

Rely on the analyst's recollection and the SOAR case notes timestamps, since the playbook already recorded each automated action taken during response

Answer

Re-run the SOAR evidence-collection playbook step now against the terminated pod to recover the volatile memory and process tree that was missed

Answer

Use only the SCC finding creation timestamp as the point of initial access, since SCC surfaced the threat and its timestamp is authoritative