You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat…

To enhance detection and response across a hybrid environment, a security strategy must address both data ingestion for visibility and automated enrichment for efficient response. Google Security Operations (SecOps) achieves this through its two main components. First, the SIEM component (Chronicle SIEM) ingests security logs and telemetry from on-premises and multi-cloud sources as events, creating a unified view for threat detection. Second, the SOAR component (Chronicle SOAR) uses integrations with services like Google Threat Intelligence (GTI) to automatically enrich alerts derived from these events. This enrichment provides critical context on indicators of compromise (IOCs), enabling security teams to investigate and respond to threats more effectively.

A. Ingest GTI IOCs into Google SecOps as security events.

IOCs are threat intelligence data used for correlation and detection rules, not raw, time-stamped security events like logs.

C. Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.

Logs are ingested as events. Entities (e.g., users, assets, IPs) are nouns that are automatically extracted and correlated from event data.

E. Use Google SecOps SOAR integrations with GTI for entity enrichment.

While the enrichment process focuses on entities (like an IP or hash) within an alert, "event enrichment" is the broader, standard term for the overall SOAR process of adding context to an alert.

1. Google Cloud Documentation

Chronicle SIEM Overview: "Chronicle SIEM is a cloud-native security information and event management (SIEM) solution... Chronicle SIEM can ingest a wide variety of security telemetry and network telemetry from a broad range of sources... This data includes events such as user login attempts

network traffic from firewalls

and endpoint process execution." This supports option B

as the fundamental step is ingesting logs as events.

2. Google Cloud Documentation

Chronicle SOAR Overview: "Chronicle SOAR is a cloud-native security orchestration

automation

and response (SOAR) solution... Integrations with enrichment and threat intelligence services provide more context about indicators of compromise (IOCs)." This supports option D

highlighting the use of SOAR integrations for enrichment to improve response.

3. Google Cloud Documentation

Unified Data Model (UDM) Overview: "The Unified Data Model (UDM) is a Google Security Operations data structure... that describes what data is being collected... An event is a record of an action that occurred in the customer's environment... An entity is a noun

such as a user

asset

domain

or resource." This reference clarifies the distinction between events and entities

showing why option C is incorrect.

4. Google Cloud Documentation

About Chronicle SIEM threat intelligence: "Chronicle SIEM curates and provides several threat intelligence feeds... You can also import threat intelligence feeds from third-party providers... You use threat intelligence in rules to evaluate devices in your enterprise against known threats." This explains that IOCs are used as intelligence feeds for rules

not ingested as security events

making option A incorrect.