Google Cloud Professional Security Operations EngineerStudy guide

Understand prioritizing telemetry sources (Security Command Center [SCC], Google SecOps, Google Threat Intelligence [GTI], Cloud IDS), integrating multiple tools to enhance detection, justifying tools with overlapping capabilities, evaluating coverage gaps of existing tools, and evaluating automation/cloud tools to enhance detection/response processes.

Understand user/service account authentication to security tools (SCC, Google SecOps), authorizing feature access and data access via IAM roles/permissions, configuring/analyzing audit logs (Cloud Audit Logs, data access logs), configuring API access for automation (service accounts, API keys, SCC/SecOps/GTI), and provisioning identities with Workforce Identity Federation.

Understand determining data-ingestion approaches in security tools (SCC, Google SecOps), configuring ingestion tools/features, assessing required logs for detection/response (incl. automated sources, SCC Event Threat Detection), evaluating Google SecOps parsers and configuring parser modifications/extensions, data normalization (UDM) from log sources, evaluating new labels, and managing log/ingestion costs.

Understand identifying relevant threat intelligence in the enterprise, differentiating event vs entity data log sources (Cloud Audit Logs, Active Directory organizational context), and evaluating event/entity data matches for enrichment using aliasing fields.

Understand developing queries across environment logs to find anomalous activity, analyzing user behavior for anomalies, investigating network/endpoints/services for IOCs with Google Cloud tools (Logs Explorer, Log Analytics, BigQuery, Google SecOps), collaborating with incident response, and developing hypotheses from behavior/threat intel/posture/incident data.

Understand searching IOCs in historical logs, identifying new attack patterns/techniques in real time using threat intelligence and risk assessments (GTI, detection rules, SCC toxic combinations), analyzing entity risk score for anomalies, retrohunting historical events with newly enriched logs (Google SecOps rules engine, BigQuery, Cloud Logging), and proactively searching for underlying threats with threat intelligence.

Understand reconciling threat intelligence with user/asset activity, analyzing logs/events for anomalies, detection rules and searches across timelines, detection rules using risk values (Google SecOps reference lists), assigning risk values (Google SecOps Risk Analytics, curated detection rules), detecting posture/risk-profile changes (SCC Security Health Analytics, posture management), identifying low-prevalence processes/domains/IPs (YARA-L rules), using entity/context data (SecOps entity graph), and SCC Event Threat Detection custom detectors.

Understand scoring alerts based on the risk level of IOCs, searching ingested security telemetry with the latest IOCs, and measuring the frequency of repetitive alerts to identify and reduce false positives.

Understand collecting evidence on incident scope (forensic images/artifacts), observing/analyzing alerts (SCC, Google SecOps), analyzing scope with tools (Logs Explorer, Log Analytics, BigQuery, Cloud Logging, Cloud Monitoring), collaborating with teams, isolating affected services/processes, forensic analysis (Hash, IP, URL, binaries via GTI), and root cause analysis (SCC, Google SecOps SIEM).

Understand determining response steps for automation, prioritizing high-value enrichments by threat profile, evaluating integrations for playbooks, designing new processes for new attack patterns, recommending new orchestrations/automation playbooks based on gaps (Google SecOps SOAR), notifying analysts/stakeholders, and the case management lifecycle (assigning response stages, escalation workflows, assessing handoff effectiveness).

Understand identifying key security analytics (metrics, KPIs, trends), implementing dashboards to visualize security telemetry, ingestion metrics, detections, alerts, and IOCs (Google SecOps SOAR, SIEM, Looker Studio), and generating/customizing reports.

Understand identifying important metrics for health monitoring/alerts, creating dashboards that centralize metrics, creating threshold alerts for specific metrics, configuring notifications with Google Cloud tools (Cloud Monitoring), identifying health issues with Google Cloud tools (Cloud Logging), and configuring silent source detection.