You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IoCs that you suspect were generated due to the exercise. What should you do?
Ask Gemini to provide a list of IoCs from the red team exercise.
Filter IoCs with an ingestion time that matches the time period of the red team exercise.
Navigate to the IOC Matches page. Identify and mute the IoCs from the red team exercise.
Navigate to the IOC Matches page. Review IoCs with an Indicator Confidence Score (IC-Score) label > = 80%.