You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

• A. Create a parser extension to correct the time zone.
• B. Create a custom parser to correct the time zone.
• C. Modify the UI settings to correct the time zone.
• D. Modify the default parser and include a default time zone.

Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?

• A. Add a custom filter to the dashboard.
• B. Ask Cloud Customer Care to add a custom filter to the dashboard.
• C. Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.
• D. Copy an existing dashboard and add a custom filter.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• B. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• C. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• D. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• E. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.

You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

• A. Enrich the IP address entities as the initial step of the playbook.
• B. Create an outcome variable in the rule to assign the network name.
• C. Modify the entity attribute in the alert overview.
• D. Configure each network in the Google SecOps SOAR settings.