What's changed: Created Professional Security Operations Engineer Chapter 3 (Domain 3 "Threat hunting": cross-environment queries/user behavior analysis/investigation with Logs Explorer-Log Analytics-BigQuery-Google SecOps/IOCs/IR collaboration/hypotheses; GTI IOC search in historical logs/SCC toxic combinations/entity risk score/retrohunt (Google SecOps rules engine-BigQuery-Cloud Logging)/proactive search).
3.2Leveraging threat intelligence and retrohunt
Understand searching IOCs in historical logs, identifying new attack patterns/techniques in real time using threat intelligence and risk assessments (GTI, detection rules, SCC toxic combinations), analyzing entity risk score for anomalies, retrohunting historical events with newly enriched logs (Google SecOps rules engine, BigQuery, Cloud Logging), and proactively searching for underlying threats with threat intelligence.
Threat intelligence turns "unknown into known." Use new IOCs to look back in time and surface high-risk combinations and anomalies.
3.2.1Threat intelligence and risk assessment
Pull the latest threat data from GTI and search IOCs in historical logs (malicious IPs/domains/hashes) for traces of compromise. Identify new attack patterns/techniques by applying threat intelligence and risk assessment in real time. Evaluate SCC toxic combinations (chains of configs/permissions that are individually low-risk but critical together—e.g., a public bucket + an over-privileged SA) to pre-empt attack paths. Use entity risk score to find users/assets whose risk spiked above normal, analyzing anomalous behavior. Map "chained weaknesses becoming critical = toxic combination" and "spiked-risk target = entity risk score."
3.2.2Retrohunt and proactive search
When you have new detection logic or newly enriched data, apply it retroactively to historical event data via retrohunt to find missed compromise (re-apply rules to past logs with the Google SecOps rules engine; also retroactive search in BigQuery/Cloud Logging). Then proactively search for underlying threats not yet alerting, using threat intelligence (GTI, detection rules). Map "apply new rules/IOCs retroactively to the past = retrohunt."
Common: requirement → means. E.g., "apply the latest IOCs to historical logs for compromise traces" = IOC search in historical logs/retrohunt; "configs low-risk alone but critical when chained" = SCC toxic combinations; "a target whose risk spiked above normal" = entity risk score; "re-apply a new detection rule to past events" = Google SecOps rules-engine retrohunt.
Watch the mix-ups: (1) Retrohunt (backward in time) vs real-time detection (forward) are opposite directions—apply new IOCs to both. (2) Toxic combinations (chained risk) vs a single vulnerability/misconfig differ—look at combinations. (3) Entity risk score watches "relative spikes"—don't judge by absolute value alone.
3.2.3Section summary
- Search GTI IOCs in historical logs; chained risk = SCC toxic combinations; spikes = entity risk score
- Apply new rules/enrichment to past events = retrohunt (SecOps rules engine/BigQuery/Cloud Logging)
- Proactively search for underlying threats with threat intelligence
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To apply newly known malicious IOCs retroactively to previously ingested logs and find missed compromise—what is this?
Q2. To evaluate chains of configs/permissions that are low-risk alone but critical together (e.g., public bucket + over-privileged SA), what in SCC?
Q3. To find users/assets whose risk spiked above normal and analyze anomalous behavior, which is best?
Q4. To search the latest threat-intel IOCs within previously ingested security telemetry, which is best?
Q5. In proactive hunting for underlying threats, how should you use threat intelligence?