Question

A SecOps engineer needs to enrich incoming firewall events with the business owner, department, and criticality tier for each internal source IP so that detection rules can filter on these attributes. The mapping contains roughly 8,000 rows with multiple columns per IP and is updated weekly from a CMDB export. The engineer wants the enrichment values to be queryable as structured fields within YARA-L rules and search. Which approach best fits this requirement?

Accepted Answer

Load the CMDB export into a Google SecOps data table with the source IP as a key column and reference the multi-column rows in detection rules and search

Answer

Store the mapping in a single reference list of newline-delimited IP strings and match events against it in rule logic

Answer

Embed the 8,000-row mapping directly in each YARA-L rule as inline literals updated manually each week

Answer

Write a custom parser extension that hard-codes the owner and criticality values into the UDM event during ingestion