Question

A large enterprise runs a single Google SecOps tenant shared by three regional SOC teams (EMEA, APAC, Americas). Each team must only investigate alerts and search logs that originate from assets in their own region, and a central detection engineering team must author and deploy rules that apply across all regions. Compliance requires that an EMEA analyst can never view APAC log data, even within search results. Which approach best enforces this requirement while preserving the central team's cross-region rule authoring?

Accepted Answer

Configure data RBAC by labeling ingested telemetry with region scopes and binding each SOC team's role to its regional label set, while granting the detection engineering team a role with rule-management privileges scoped across all labels.

Answer

Create three separate SecOps tenants, one per region, and replicate the central team's rules into each tenant manually.

Answer

Grant all SOC analysts a global viewer role and rely on saved search filters that restrict results to each analyst's region.

Answer

Assign each SOC team a feature-level IAM role limiting which SecOps UI pages they can open, and give the detection team the administrator role.