An enterprise organization is designing a centralized logging, threat detection, and security analytics architecture across Google Cloud and hybrid environments. The Security Operations Center (SOC) team needs to achieve the following requirements: Ingest and normalize diverse log sources (including cloud audit logs, web proxy logs, and endpoint telemetry) into a standard schema for fast threat hunting and multi-event correlation. Write custom behavioral detection rules that correlate disparate entities (such as IP addresses, users, and processes) across time windows. Integrate native Google Cloud threat intelligence findings alongside third-party telemetry in a single security analytics repository. Which logging and threat detection strategy should the organization implement?

Ingest logs into Google SecOps (Chronicle SIEM) using parsers to map raw fields to the Unified Data Model (UDM), write detection rules using YARA-L, and stream Security Command Center findings for centralized correlation.: ### What Google SecOps and the Unified Data Model (UDM) are **Google SecOps** (formerly Chronicle SIEM) is a cloud-native Security Information and Event Management platform designed to ingest, normalize, and analyze massive volumes of security telemetry at scale. Central to its architecture is the **Unified Data Model (UDM)**, a standardized data schema that structures and normalizes heterogeneous logs—such as proxy logs, authentication events, firewall traffic, and endpoint telemetry—into consistent entity and event objects (for example, `principal`, `target`, `network`, and `security_result`). ### How it meets the requirements - **Log Normalization and Structuring**: Built-in and custom parsers extract unstructured or variable-format log fields (such as client IP, user identity, process paths, and HTTP attributes) and map them directly into structured **UDM fields** (`principal.ip`, `principal.user.userid`, `target.process.file.full_path`). This enables unified, high-speed querying across disparate log formats without custom per-source syntax. - **Custom Threat Detection Rules**: Google SecOps utilizes **YARA-L 2.0**, a powerful detection language explicitly designed to correlate normalized UDM events over custom time windows, tracking multi-stage attacker behavior and anomalous activities across disparate data sources. - **Unified Threat and Finding Integration**: Native **Security Command Center (SCC)** findings (including Event Threat Detection and VM Threat Detection) can be continuously ingested and mapped into UDM event structures (`security_result`), creating a unified security analytics pane for comprehensive threat hunting. ### Key advantages and capabilities - **Massive Scalability**: Enables real-time indexing and multi-year retention of petabytes of telemetry with sub-second query performance. - **Out-of-the-Box Normalization**: Includes hundreds of pre-built parsers for mainstream network, identity, cloud, and endpoint security vendors. - **Entity Resolution**: Automatically correlates ephemeral IP addresses and hostnames to specific physical or cloud assets at any given point in time. - **Contextual Enrichment**: Automatically enriches normalized logs with Google threat intelligence (VirusTotal, Mandiant) and asset context. ### Why this is optimal Compared to constructing custom data pipelines using databases or monitoring metrics, Google SecOps natively delivers purpose-built SIEM functionality, normalized data models, rule engines, and threat intelligence mapping specifically engineered for enterprise SOC threat hunting and detection engineering.

Secops Udm Normalization Threat Detection Siem | Professional Cloud Security Engineer

Secops Udm Normalization Threat Detection Siem

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing a centralized logging, threat detection, and security analytics architecture across Google Cloud and hybrid environments. The Security Operations Center (SOC) team needs to achieve the following requirements:

Ingest and normalize diverse log sources (including cloud audit logs, web proxy logs, and endpoint telemetry) into a standard schema for fast threat hunting and multi-event correlation.
Write custom behavioral detection rules that correlate disparate entities (such as IP addresses, users, and processes) across time windows.
Integrate native Google Cloud threat intelligence findings alongside third-party telemetry in a single security analytics repository.

Which logging and threat detection strategy should the organization implement?

Ingest logs into Google SecOps (Chronicle SIEM) using parsers to map raw fields to the Unified Data Model (UDM), write detection rules using YARA-L, and stream Security Command Center findings for centralized correlation.

Create log-based counter and distribution metrics in Cloud Logging for every third-party log field, export the metric time-series to Cloud Monitoring, and create Monitoring Query Language (MQL) alerting policies.

Route raw logs through Eventarc standard channels to trigger Cloud Workflows for real-time JSON parsing, and persist the transformed output into Cloud Firestore collections for threat hunting.

Export all raw logs to Cloud Storage buckets, create BigQuery external tables with regex-based SQL views for field extraction, and deploy scheduled Cloud Functions to generate alerts in Security Command Center.

Professional Cloud Security Engineer

Secops Udm Normalization Threat Detection Siem

Related questions