Question

Your SOC uses Security Command Center (SCC), Google SecOps (SIEM/SOAR), Google Threat Intelligence (GTI), and Cloud IDS. Analysts report that east-west (VM-to-VM) traffic containing exploit attempts against internal services is going undetected until well after compromise. Leadership asks you to justify which telemetry source should be prioritized to close this specific detection gap, and how it fits the architecture. Which recommendation best addresses the gap?

Accepted Answer

Prioritize Cloud IDS by mirroring internal VPC traffic to it and forwarding its threat findings into Google SecOps for correlation and response.

Answer

Prioritize SCC Security Health Analytics to detect misconfigurations on the affected VMs, since that will surface the vulnerable services.

Answer

Prioritize GTI enrichment of existing SecOps alerts so known-bad indicators in the exploit traffic are flagged automatically.

Answer

Prioritize SCC Event Threat Detection on Cloud Audit Logs to identify the API calls associated with the lateral movement.