PSOE — frequently asked questions

A network block list on egress only stops internet traffic; it does not prevent the host from scanning or moving laterally inside the network, nor does it stop malicious local file changes.

Rebooting erases volatile memory and running persistence artifacts before evidence is captured, so it is eradication performed before containment and forensics are complete.

Isolating the asset keeps disk contents, memory, process state, and logs intact and on-network-readable by SecOps, allowing the responder to determine scope and root cause.

IOCs are a detection input: they decide whether a rule fires, so they can even add noise from stale indicators. The problem here is ranking the alerts that already fire, which requires asset-sensitivity context from the CMDB.

Ingested HVA records act as reference data rules can match against, letting detections score or escalate alerts on critical hosts, IPs, and users while downgrading activity on non-sensitive assets — improving the working positive ratio.

Yes, the rules may still fire, but low-impact alerts sink in priority so analysts spend time on high-value alerts first, which is what stops true positives from being missed in a high-volume queue.

A standard VirusTotal upload shares the sample and its scan results with the broader community and scanning vendors, which an advanced threat group monitoring for its custom tool would likely observe, ending your covert access to it.

The sample was developed specifically for your organization and is brand new, so its hash will not exist in any intelligence repository; a checksum lookup returns no behavior or IOC data about a file you already hold.

A UDM search requires manual execution and review every time you need updated data. For regular baselining across many servers, a dashboard automates this aggregation.

No. Alerts typically trigger on anomalies or known threats. Normal, benign processes often do not generate alerts, so relying on them creates an incomplete baseline.

Risk Analytics only shows scores from pre-configured risk rules and does not let you pivot on specific IOCs. Use UDM Search first for direct correlation, then check risk signals as a follow-up.

Both are containment actions taken before you have evidence the logins are coordinated. Block or disable only after the search confirms the pattern and scope of the attack.

Organization Policies enforce compliance by preventing changes, but the question specifically asks for 'monitoring and alerting' to identify existing or new violations, which SHA provides via findings.

Yes, SHA findings are associated with resources, and you can filter or create alerts based on resource labels and tags within Security Command Center.

Risk Analytics scores Asset entities (hostnames, IPs, MACs) and User entities; domains are not tracked as standalone scored entities, so you cannot get domain prevalence or first-seen data there.

Those sources are already normalized into UDM, so a UDM search gives you consistent domain fields, entity mapping, and prevalence/first-seen enrichment that raw logs do not.

Applied Threat Intelligence is enabled, so newly observed and newly matched domain indicators appear there with first-seen and last-seen timestamps and an IOC drilldown into full context.

A scheduled job must wait for its next run to scan cases and attach a playbook, adding latency and complexity. Branching inside the triggered playbook with Flow Condition routes the case immediately and event-driven.

Multi-Choice Question flows pause the playbook for an analyst to read instructions and pick an answer, which is manual, slower, and error-prone. The question explicitly requires an automatic and efficient split.

A hash-linked high-frequency rule still depends on inconsistently captured process hashes, causing false negatives, and it only alerts on new events without retrohunting past EDR, DNS, and Sysmon telemetry.

Hashes are not reliably logged on all endpoints due to inconsistent Sysmon configuration, so a hash-only rule misses executions on affected hosts; behavioral correlation plus retrohunting is required.

While Ops Agent can collect logs, Bindplane is specifically designed as a managed telemetry agent for SecOps ingestion, offering better preprocessing and lower overhead for this specific integration.

Cloud Storage is typically used for archival or batch processing, not for minimizing time and cost for active application log ingestion into SecOps where Bindplane is available.

They are behavioral event sources, so they add process and script telemetry but never supply the canonical user identity records needed to normalize principal.user.userid across sources.

Entra ID is the authoritative identity provider for those endpoints, and its audit and sign-in logs carry the user identifiers SecOps maps into principal.user.userid for YARA-L matches.

It converts raw entries only into additional.fields as generic key-value pairs, so the renamed field never reaches its core UDM field and dependent rules, dashboards, and detections keep failing.

Forking the entire parser duplicates a Google-maintained asset, increases maintenance overhead, and takes longer than an additive parser extension that only maps the two missing fields.

YARA-L is for writing detection rules and correlating events. Behavioral Analytics provides pre-calculated risk scores and contextual insights into user anomalies, which is faster for investigation.

User Sign-In Overview tracks authentication events like logins. Behavioral Analytics analyzes broader activity patterns (like PowerShell usage and network connections) to detect deviations from baseline behavior.

EDR detects local process creation but lacks the identity context needed to track cross-resource lateral movement and access policy violations in a cloud environment.

Yes, in cloud contexts, lateral movement is often facilitated by identity abuse (e.g., role assumption), which is directly visible in IAM logs.

They only show network connections, not whether an SSH authentication attempt succeeded or failed.

It provides aggregated, structured findings rather than streaming raw logs, significantly lowering volume.

Grouped fields aggregate multiple IP types, obscuring whether traffic was inbound or outbound. Directionality is critical for C2 analysis, so explicit fields like src.ip and target.ip are necessary.

SOAR playbooks automate response actions, but initial investigation and traffic identification are best performed via SIEM Search to gather evidence before triggering automated workflows.

Linking a project doesn't handle the authentication of external users. Federation is needed to map third-party IdP identities to Google Cloud workforce identities.

No, SOAR settings are for application-specific configurations. Platform-wide access for federated users is controlled via Google Cloud IAM.

Feed management is built for pulling from cloud-resident sources such as Cloud Storage, Pub/Sub, and AWS/Azure feeds. Standalone on-premises Syslog endpoints are collected by a Bindplane agent installed at the source.

An ingestion label maps incoming data to a log type and its parsing schema. An asset namespace scopes asset identity so that identical IP addresses in different environments are tracked as separate assets instead of being aliased.