Question

A security operations team wants detections in Google SecOps to automatically incorporate business context so that alerts on high-value hosts (e.g., domain controllers, payment servers) can be triaged first. They already ingest their CMDB export, which maps hostnames to asset owner, business unit, and criticality tier. The team wants this business context to appear as enrichment on UDM events at detection time, and to be usable within YARA-L rule logic. Which approach best meets this requirement?

Accepted Answer

Ingest the CMDB export as a context (entity) data feed so it is stored as entity graph context and joined to UDM events, then reference the enriched fields in YARA-L rules.

Answer

Write a custom CBN parser that hard-codes each hostname-to-criticality mapping into the parser configuration and redeploy the parser whenever the CMDB changes.

Answer

Store the CMDB data in a SOAR playbook variable and enrich alerts only after they are forwarded to SecOps SOAR for response.

Answer

Add the criticality tier as a free-text label on the log source so all events from that forwarder inherit the same tier.