Investigating C2 IP Traffic in Google SecOps SIEM

PSOE Last updated

Performing threat hunting across environments.

Short answer

C Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.

Question

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

  1. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
  2. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
  3. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address. Correct Answer
  4. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

Key Takeaways

The exam tests the distinction between broad grouped searches and specific directional queries, with the common trap being the assumption that 'grouped' fields are always more efficient or comprehensive.

This question addresses how to effectively investigate Command and Control (C2) IP traffic using Google Security Operations SIEM Search. It establishes that explicit field targeting is superior for determining traffic directionality during threat hunting.

Common mistake: Candidates often choose Option D because it mentions 'grouped ip' and 'enriched fields', assuming this broader search covers more ground, but it fails to provide the critical directional context needed for a C2 investigation.

Expert Analysis

Why the Answer Is Correct

Option C is correct because investigating a Command and Control (C2) IP requires understanding the direction of communication to determine if internal assets are compromised (outbound) or if external actors are probing (inbound). By explicitly querying src.ip and target.ip, the analyst can clearly distinguish between inbound connections to the C2 IP and outbound connections from the C2 IP to internal hosts. This granularity is essential for accurate threat assessment and subsequent containment steps.

Why the Other Options Are Wrong

Option A involves SOAR playbooks, which are typically automated responses rather than initial investigative queries; while useful later, they do not constitute the primary method for manual traffic analysis in this context. Option B suggests searching cases, which looks for existing records rather than raw network traffic logs. Option D uses the grouped ip field, which aggregates various IP fields (like principal.ip, src.ip, target.ip) into one bucket. While convenient, this aggregation obscures the specific directionality required to analyze the C2 relationship, making it less precise than Option C.

Community Comment Notes

Community feedback highlights the importance of traffic directionality. As user b925054 noted, "When investigating a Command and Control (C2) IP address, understanding the directionality of the network traffic is critical." Another comment emphasizes that while grouped fields exist, "Explicitly using src.ip and target.ip is a better practice here because it clearly delineates the direction of the traffic," reinforcing why D is inferior to C despite its apparent breadth.

Exam Strategy

Always prioritize precision over breadth when analyzing security alerts. If an option allows you to isolate specific data points (like traffic direction) versus aggregating them, the specific option is usually the correct investigative step unless automation is explicitly requested.

Frequently Asked Questions

Why is the grouped ip field (Option D) not preferred for C2 investigations?

Grouped fields aggregate multiple IP types, obscuring whether traffic was inbound or outbound. Directionality is critical for C2 analysis, so explicit fields like src.ip and target.ip are necessary.

Should I use SOAR playbooks instead of SIEM Search for C2 IPs?

SOAR playbooks automate response actions, but initial investigation and traffic identification are best performed via SIEM Search to gather evidence before triggering automated workflows.

More PSOE FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 4

  1. b925054 👍 1
    While Google SecOps does feature grouped fields (like ip) that allow you to search across multiple IP-related fields simultaneously (such as principal.ip, target.ip, src.ip, etc.), this approach lumps all the results together. Explicitly using src.ip and target.ip is a better practice here because it clearly delineates the direction of the traffic, which is vital context during a C2 investigation.
  2. b925054 👍 1 Answered C
    When investigating a Command and Control (C2) IP address, understanding the directionality of the network traffic is critical to determining the scope of the compromise. target.ip: help you identify outbound traffic while src.ip: help you identify inbound traffic.
  3. 751dd03 👍 1 Answered D
    D makes the most sense. Using a grouped field will broaden the search beyond just src.ip and target.ip.
  4. ecd484d 👍 1 Answered D
    I think its D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Ingesting On-Prem NAS Logs into Google SecOps Without IP Aliasing

S-Grade

Which Log Source Completes principal.user.userid Matching?

S-Grade

Reducing Secops Alert Noise with High-Value Asset Context

S-Grade

← Back to PSOE Study Guide