What's changed: Created Professional Security Operations Engineer Chapter 4 (Domain 4 "Detection engineering": reconciling threat intel with activity/detection rules (YARA-L)/reference lists/risk values/Risk Analytics/curated detection rules/SCC Security Health Analytics-posture management/low-prevalence processes-domains-IPs/entity graph/SCC Event Threat Detection custom detectors; IOC-risk alert scoring/searching telemetry with latest IOCs/measuring repetitive-alert frequency to reduce false positives).
4.1Developing and implementing detection mechanisms
Understand reconciling threat intelligence with user/asset activity, analyzing logs/events for anomalies, detection rules and searches across timelines, detection rules using risk values (Google SecOps reference lists), assigning risk values (Google SecOps Risk Analytics, curated detection rules), detecting posture/risk-profile changes (SCC Security Health Analytics, posture management), identifying low-prevalence processes/domains/IPs (YARA-L rules), using entity/context data (SecOps entity graph), and SCC Event Threat Detection custom detectors.
Detection engineering is the core skill of building mechanisms that find threats automatically. Write rules, weight by risk, and raise accuracy with context.
4.1.1Detection rules and risk values
In Google SecOps, detection rules (the YARA-L language) detect suspicious behavior from logs/events. Reconcile threat intelligence with user/asset activity, and search across multiple timelines. Keep known-bad values or watchlists in reference lists, referenced by rules and weighted by risk values. Enable ready-to-use curated detection rules (provided by Google), assign risk scores to detections with Risk Analytics, and prioritize threats matching the risk profile. Low-prevalence (new/rare) processes/domains/IPs—even if absent from threat intel—signal anomalies, so surface them with YARA-L and dashboards. Map "detection rule for suspicious behavior = YARA-L," "list of known values/watchlists = reference lists," and "assign risk to detections = Risk Analytics."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.