Threat Hunting Low-Prevalence External Domains in Google SecOps
Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps: Firewall logs Proxy logs DNS logs DHCP logs What should you do? (Choose two.)
Community Insight
The question tests where prevalence, first-seen timing, and Applied Threat Intelligence data actually live in SecOps: the trap is confusing entity-centric Risk Analytics, raw log search, or geolocation-first-seen logic with the correct UDM and IOC Matches workflows.
This PSOE threat-hunting scenario asks how to chase anomalous external-domain communications across firewall, proxy, DNS, and DHCP logs in Google SecOps with Applied Threat Intelligence enabled. The correct approach combines a UDM search for low-prevalence, recently first-seen domains with pivoting from the IOC Matches page using the IOC drilldown.
The most common wrong pick is D (Risk Analytics), because its dashboards score and visualize Asset entities such as hostnames, IPs, and MAC addresses and User entities — domains are not tracked as standalone scored entities there, so drilling into 'higher normalized risk domains' is a dead end for this hunt.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the canonical hunting move: a UDM search across normalized firewall, proxy, DNS, and DHCP events for external domains with low prevalence that were first seen in the last 30 days isolates rare, newly observed destinations — exactly the signature of beaconing, C2 lookups, and DNS tunneling. Because all four log sources are normalized into UDM, a single cross-source search on target domain fields with a first-seen/prevalence filter works, which is why a UDM search (not a raw log search) is required. Option E is equally valid because Applied Threat Intelligence is enabled: the IOC Matches page lets you filter on domain-type indicators over the last 30 days, read first-seen and last-seen timestamps for the reported domains, and pivot into full entity context using the IOC drilldown link. Together, B and E give you both the behavioral hunt (rare new domains) and the intelligence-driven hunt (newly ingested or newly matched domain IOCs).
Why the Other Options Are Wrong
Option D fails because Risk Analytics is built to calculate and visualize risk scores for Asset entities (hostnames, IP addresses, MAC addresses) and User entities; domains are not surfaced as standalone scored entities you can drill into for domain prevalence and first-seen data. Option A targets domains with geolocations first seen in the last 30 days, but geolocation first-seen is not a reliable hunt signal here — a country or city being newly seen tells you little about the domain itself, and prevalence is the attribute that surfaces anomalous communications. Option C is wrong on technique: with all four sources ingested and normalized, you must query through UDM rather than raw logs, since raw log search does not give you the unified fields, entity mapping, and prevalence/first-seen enrichment this hunt depends on.
Community Comment Notes
Eric Gao endorsed B and E together, consistent with the reasoning above. Yknjs argued that "E is not correct, this is for known indicators," but that objection does not hold here: with Applied Threat Intelligence enabled, the IOC Matches page reflects indicator matches on newly observed domains from the configured feeds, and the question explicitly directs the analyst to use the IOC drilldown link. B925054 independently confirmed the disqualification of D, noting that "Risk Analytics dashboard is designed specifically to calculate and visualize risk scores for Asset entities" and "does not track or display 'domains' as standalone entities."
Official Reference
Exam Strategy
When a SecOps hunting question offers both UDM and raw log search options, choose the UDM path unless the scenario explicitly requires an un-normalized field. Also read the feature enablement line carefully — 'Applied Threat Intelligence enabled' is a direct hint that IOC Matches and the IOC drilldown are in scope.
Frequently Asked Questions
Why is a Risk Analytics domain drilldown (option D) wrong for this threat hunt?
Risk Analytics scores Asset entities (hostnames, IPs, MACs) and User entities; domains are not tracked as standalone scored entities, so you cannot get domain prevalence or first-seen data there.
Why not do a raw log search (option C) across firewall, proxy, and DNS logs?
Those sources are already normalized into UDM, so a UDM search gives you consistent domain fields, entity mapping, and prevalence/first-seen enrichment that raw logs do not.
Why does the IOC Matches page work here when someone said it is only for known indicators?
Applied Threat Intelligence is enabled, so newly observed and newly matched domain indicators appear there with first-seen and last-seen timestamps and an IOC drilldown into full context.