Question

A SecOps analyst receives a high-severity alert in Google SecOps for suspicious OAuth token grant activity on a single user account. During triage, the analyst notices the alert is one of five similar alerts fired over the past 90 minutes, each on different accounts in the same business unit. Before deciding on containment, what is the MOST appropriate next triage action to establish accurate scope?

Accepted Answer

Pivot on the shared entities (OAuth application, source IP, and grant timestamps) across the alerts and consolidate them into a single case to assess whether they share a common root cause

Answer

Immediately disable all five user accounts and close the individual alerts as contained

Answer

Close four of the alerts as duplicates and investigate only the highest-severity one to save analyst time

Answer

Escalate each alert to a separate case and assign them to five different analysts to parallelize the response