Question

A security operations engineer notices that detections tied to a critical GKE cluster's audit logs have not fired for three days, despite normal workload activity. Historical dashboards show the cluster previously generated steady audit volume. Other log sources in Google SecOps continue ingesting normally. The engineer must determine why coverage appears to have silently degraded and how to prevent recurrence. What is the MOST appropriate first action to diagnose and address this gap?

Accepted Answer

Review the SecOps ingestion/feed health and data ingestion metrics for the GKE audit log source to confirm whether events are still arriving, then configure ingestion volume alerting to detect future silent drops

Answer

Rewrite the affected YARA-L detection rules assuming they contain a logic error that stopped matching events

Answer

Increase the data retention tier for the GKE audit log source so older events remain searchable for correlation

Answer

Escalate to reprovision the Cloud IDS endpoint associated with the cluster's subnet to restore network telemetry