Question

A detection engineer has finished authoring and validating a new YARA-L multi-event rule in Google SecOps. Testing against historical data confirmed strong precision. The team now wants the rule to generate alerts on incoming data and to also retroactively evaluate the last two weeks of stored events to catch any prior activity, without duplicating alerts already surfaced during testing. Which lifecycle action correctly achieves this?

Accepted Answer

Enable the rule's live state (Rule Live) so it evaluates streaming events, and separately run a retrohunt over the two-week window to surface historical matches.

Answer

Set the rule to Alerting only, which automatically backfills alerts for all previously ingested events in the retention period.

Answer

Duplicate the rule into a second version and mark one version as test and the other as live to cover both streaming and historical data.

Answer

Leave the rule in test mode permanently, since test executions already scan both incoming and historical events continuously.