Question

A security operations engineer at a retail company has just onboarded Cloud Audit Logs, VPC Flow Logs, and Google Workspace logs into Google SecOps. Leadership wants immediate detection value while the internal detection engineering team ramps up on writing custom YARA-L rules. The engineer must decide how to establish baseline detection coverage that is maintained by Google and automatically improves as new threats emerge. What is the most appropriate action?

Accepted Answer

Enable the relevant Google SecOps curated detection rule sets that match the ingested log sources, and verify each rule set's required data types are being received.

Answer

Wait until the detection engineering team finishes authoring the full custom YARA-L rule library before enabling any detections in production.

Answer

Forward all SecOps events to SCC and rely exclusively on SCC's built-in threat findings for detection coverage.

Answer

Export the raw logs to BigQuery and build scheduled SQL queries to replicate detection logic outside of SecOps.