You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?
Select an option, then click Submit answer.
Reference / correct answer:
Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
Most accepted answer: D. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
Community votes: C=1, D=1
Selected Answer: D Because you are excluding only specific, validated benign IP addresses, the rule remains fully effective at monitoring the rest of the network and detecting actual excessive network connections from potentially malicious sources. And Answer A (Add a threshold in the condition section) doesn't seems right because a rule designed to detect "excessive" connections likely already relies on a threshold. Simply raising this threshold to reduce noise could compromise the rule's effectiveness, causing it to miss legitimate threats that fall just below the new, higher limit. upvoted 1 times
Selected Answer: C In Google SecOps (Chronicle), a rule that triggers on "excessive connections" often fires an individual alert for every single event that meets the criteria. This creates a "flood" of alerts in the UI for what is essentially one single malicious or suspicious behavior. By using the match: section with a timeframe (like 10 minutes), you tell the detection engine to aggregate all related events into a single detection. The Benefit: Instead of 500 alerts for 500 connections, you get one alert that contains all 500 events. This drastically reduces the alert volume (noise) without changing the logic of what you are actually detecting (effectiveness). upvoted 1 times b925054 1 week ago Be reminded that the match: section is used to group events over a specific time window to calculate an aggregate (like a count), not to aggregate alerts. If the rule is already detecting "excessive" behavior, it likely already utilizes a match window to perform that calculation. upvoted 1 times ...
Be reminded that the match: section is used to group events over a specific time window to calculate an aggregate (like a count), not to aggregate alerts. If the rule is already detecting "excessive" behavior, it likely already utilizes a match window to perform that calculation. upvoted 1 times