Question

A detection engineer is building a multi-event YARA-L rule in Google SecOps to detect suspicious credential access followed by lateral movement from the same host within a 10-minute window. Leadership wants a single rule that produces alerts of varying severity: the same behavior should generate a low-severity alert when it involves one destination host, but a high-severity alert when it fans out to five or more distinct destination hosts. Without splitting this into multiple separate rules, what is the most appropriate YARA-L construct to achieve tiered severity from a single rule?

Accepted Answer

Compute a risk_score in the outcome section using conditional logic on the distinct count of destination hosts, then apply threshold bands in the condition and downstream alerting configuration

Answer

Set two static values in the meta section (severity: Low and severity: High) so SecOps chooses the correct one at match time

Answer

Add two separate match windows in the events section, one for single-host and one for multi-host activity, so each emits its own severity

Answer

Use a reference list of high-value hosts and rely on it to escalate severity automatically without any outcome logic