Google Cloud Professional Security Operations Engineer: key terms

Flashcards for this exam Google Cloud Professional Security Operations Engineer guide Class dates

• Correlation RuleSIEM logic that combines multiple events, possibly across sources and time, to identify suspicious patterns.Intermediate
• Data EnrichmentAdding context, such as threat intelligence, asset criticality, user identity or geolocation, to events and alerts.Intermediate
• Detection EngineeringThe discipline of designing, building, testing and maintaining threat detections as code.Advanced
• Google Security OperationsGoogle Cloud's security operations platform, formerly Chronicle, combining SIEM, SOAR and threat intelligence.Advanced
• Log NormalizationConverting logs from different formats into a common schema so they can be correlated and searched consistently.Intermediate
• Open Cybersecurity Schema Framework (OCSF)An open, vendor-neutral schema for normalizing security event data across tools.Advanced
• Security Data LakeA centralized repository that stores large volumes of raw and normalized security telemetry for analytics and long-term retention.Advanced
• Security Orchestration, Automation and Response (SOAR)A platform that integrates security tools and automates investigation and response workflows using playbooks.Intermediate
• SigmaA generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.Advanced
• Unified Data Model (UDM)The normalized schema Google Security Operations uses to represent security events from all sources.Advanced
• Use CaseA defined detection scenario describing what threat to detect, which data is required and how to respond.Intermediate
• YARA-LThe detection rule language used in Google Security Operations to identify threats across UDM events.Advanced