Secops Audit Log Programmatic Group Changes

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise manages its Google Cloud Identity user accounts and directory groups programmatically using automated service accounts and identity provisioning pipelines. The security operations center (SOC) must implement continuous auditing, standardized log parsing, and real-time alerting within Google Security Operations (SecOps / Chronicle) to detect unauthorized or anomalous additions to privileged administrative groups.

Which approach should the security engineer implement to properly standardize the audit logs and trigger real-time alerts on these programmatic identity modifications?

Standardize audit logs into Unified Data Model (UDM) events mapping group operations to target group identifiers and actor identities, then deploy a YARAL detection rule in the SecOps Detection Engine to alert on unauthorized actors.

Deploy OSSEC and auditd daemons on directory host instances to classify system call logs as SYSTEM_AUDIT_LOG_UNCATEGORIZED, and run CIS Ubuntu Benchmark compliance scripts.

Configure Event Threat Detection in Security Command Center to inspect VPC Flow Logs and Cloud DNS queries for group assignment API requests, and create firewall rules to block anomalous IP addresses.

Standardize directory audit logs into PROCESS_LAUNCH and PROCESS_TERMINATION UDM event types, and deploy Cloud IDS packet mirroring profiles to inspect API payloads for unauthorized group changes.

Professional Cloud Security Engineer

Secops Audit Log Programmatic Group Changes

Related questions