Question

During a hypothesis-driven hunt in Google SecOps, an analyst suspects a compromised host is communicating with attacker infrastructure. They have a list of 40 external IP addresses observed in outbound connections over the past week. The analyst wants to quickly determine which of these IPs are already associated with known malicious activity according to Google Threat Intelligence (GTI), so they can focus the investigation. Which approach best leverages GTI enrichment within SecOps to triage this list efficiently?

Accepted Answer

Run a UDM search filtering on the graph.metadata.threat.category field, which is populated automatically when GTI enrichment matches an event's target.ip against known IOC context, then prioritize IPs with high-confidence associations.

Answer

Manually submit each of the 40 IPs to an external open-source reputation website and record the results in a spreadsheet before returning to SecOps to search.

Answer

Create a reference list of the 40 IPs and write a YARA-L rule that alerts on any future outbound traffic to them, then wait for detections to fire over the next several days.

Answer

Export the raw logs containing the 40 IPs and re-ingest them with a custom parser that adds a threat score field derived from static CIDR ranges.