Question

A threat hunter in Google SecOps is building a YARA-L 2.0 rule to operationalize a hypothesis-driven hunt. They want the rule to fire only when an outbound network connection's destination domain matches an IOC that Google Threat Intelligence (GTI) has enriched onto the event, AND only when GTI's confidence score for that indicator is high enough to reduce noise. Which approach correctly leverages the GTI enrichment data within the rule's event and condition sections?

Accepted Answer

Match the outbound event where the destination domain equals a GTI-enriched indicator and add a condition comparing the GTI confidence field (e.g., graph.entity.metadata.threat.confidence_score) against a defined threshold.

Answer

Match on network.dns.questions.name and manually maintain a reference list of malicious domains, ignoring the GTI enrichment fields entirely since YARA-L cannot read enrichment data.

Answer

Filter on the security_result.threat_feed_name field alone, because the presence of any GTI feed name guarantees the indicator is malicious and confidence scoring is unnecessary.

Answer

Reference the GTI-populated enrichment field (e.g., $e.network.http.user_agent) as the join key, since GTI writes confidence values into the user agent field on matched events.