Question

A detection engineer at a financial services firm has authored a new YARA-L single-event rule to flag suspicious OAuth token grants. Before enabling live alerting, the team lead requires evidence that the rule fires correctly against known past incidents and does not generate excessive noise. The engineer wants to validate the rule against 30 days of already-ingested UDM events without creating alerts or notifications. Which Google SecOps capability should the engineer use to accomplish this?

Accepted Answer

Run the rule in test mode using the retrohunt (run against historical data) feature to evaluate matches over the past 30 days before enabling live detection.

Answer

Enable the rule with live alerting immediately in production and monitor the alert queue for two days to gauge fire rate.

Answer

Export 30 days of UDM events to a BigQuery table and manually reconstruct the YARA-L logic in SQL to estimate matches.

Answer

Add the rule to a curated detection set so Google validates it against Google's global telemetry baseline.