MENU
You are conducting proactive threat hunting in your company's Google Cloud environment. You suspect that an attacker compromised a developer's credentials and is attempting to move laterally from a development Google Kubernetes Engine (GKE) cluster to critical production systems. You need to identify IoCs and prioritize investigative actions by using Google Cloud's security tools before analyzing raw logs in detail. What should you do next?
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The key requirements are to 'proactively hunt,' 'prioritize investigative actions,' and identify 'lateral movement' paths before deep log analysis. This is the primary use case for Security Command Center (SCC) Enterprise. SCC aggregates all findings from Google Cloud services and correlates them with assets. By filtering on the GKE cluster, the analyst can see all associated findings (e.g., from Event Threat Detection) which may contain initial IoCs.
More importantly, SCC's attack path simulation feature is specifically designed to 'prioritize investigative actions' by modeling how an attacker could move laterally. It visualizes the chain of exploits---such as a misconfigured GKE service account with excessive permissions, combined with a public-facing service---that an attacker could use to pivot from the development cluster to high-value production systems. Each path is given an attack exposure score, allowing the hunter to immediately focus on the most critical risks.
Option C is too narrow, as it only checks for malware on nodes, not the lateral movement path. Option B is a later step used to enrich IoCs after they are found. Option D is an automated response (SOAR), not a proactive hunting and prioritization step.
(Reference: Google Cloud documentation, 'Security Command Center overview'; 'Attack path simulation and attack exposure scores')