Question

A SOC using Google SecOps SOAR receives a burst of 40 separate alerts within 15 minutes, all referencing brute-force login attempts against the same set of externally facing VPN accounts from a shared range of source IPs. Analysts are opening a new case for each alert, causing duplicated investigation effort and inconsistent response actions. As the SecOps engineer, what is the most effective way to improve triage efficiency for this recurring pattern?

Accepted Answer

Configure a grouping (alert-to-case correlation) rule so alerts sharing key entities such as source IP range and target account are consolidated into a single case for unified investigation.

Answer

Increase the alert severity threshold so only the highest-severity brute-force alert generates a case and the rest are dropped.

Answer

Disable the brute-force detection rule during business hours to reduce the volume of cases reaching analysts.

Answer

Route each individual alert to a separate playbook instance that independently blocks the source IP without correlating the alerts.