You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors. What should you do?

• A. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.
• B. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
• C. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
• D. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCS and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
• B. Create a Security Health Analytics (SHA) custom module using the compute address resource.
• C. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
• D. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.

You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

• A. Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
• B. Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
• C. Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
• D. Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.

You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?

• A. Deploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.
• B. Use Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
• C. Ingest Google Cloud Armor logs by using Cloud Logging.
• D. Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• B. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
• C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
• D. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.