Questions

 

A commonly used set of actions can be saved as a block. In addition to saving the operator time and reproducibility, which of the following is a benefit of using blocks?

 

• A block can merge playbooks
• Custom python code must be contained in a block
• Additional functions are accessible in a block
• Updating a block, updates it everywhere.

 

 

When creating a Playbook in Google SecOps, it is important to understand how playbooks will be triggered. How is a playbook triggered?

 

• Manual Intervention
• Cases
• Rules
• Alerts

 

 

There are two methods that can be used to manage Google SecOps parsers (CBNs), what are they?

 

• Parser Management UI, CLI Tool
• Parser Extension UI, gcloud parser terminal
• CBN Parser API Extension, logstash graph interface
• Parser Management UI, grok TUI

 

 

What parser function can be used to display the current state of the data being processing by the parser?

 

• printf()
• statedump
• dump
• line_24_print

 

 

Data Labels or LogTypes are metadata that associate a particular log stream with the parser that will fit the data to the UDM schema. What API and API endpoint allow you to pull the names of ALL supported Log Types?

 

• Collector API, Data Labels
• Feed Management API, Logtypes
• Parsing API, Data Labels
• Ingestion API, Logtypes

 

 

Google SecOps parsers leverage a widely used and open source tool used to collect, process, and transform data. The syntax of Google SecOps parsers is based on this tool. What is it?

 

• Graylog
• sawmill
• Logstash
• Beats