Questions

 

Google SecOps can accept and reference data that describes objects such as devices, users, machines, and file hashes. How can that dat a be used in YARA-L based Threat Detection?

 

• Using the entity graph syntax
• preprending ‘e’ to the field name
• referencing functions that use Google Threat Intel
• Using a join from an external database

 

 

What is the name of the API that enables users to create and manage rules?

 

• Detection Engine API
• Ingestion API
• Threat Rule API
• Alert API

 

 

The Google SecOps search interface provides two methods to search data. What are they?

 

• Raw and Event
• Event and Entity
• Raw and Alerts
• Raw and UDM

 

 

When writing regular expressions in Google SecOps it is best to combine multiple regex statements into one, when possible and to use built-in functions instead of building your own patterns. Which of the following is a built-in function to YARA-L?

 

• net.ip_range_in_cidr
• uint.cc_number
• text.hash_id
• number.postal_code

 

 

UDM has two major types of data, one is Event data and the other is Entity data. What are the 3 types of Entity Sources?

 

• Time Context, Device Context, Domain Context
• Entity Context, Derived Context, Global Context
• Name Context, IP Context, Hash Context
• Local Context, Inferred Context, Universal Context

 

 

Playbook Views in Google SecOps can do several things, but which of the following are NOT one a feature of Playbook Views?

 

• Run a playbook
• Display HTML widgets
• Display highlighted entities
• Customizable by user role