For enrichment actions where the enrichment tech is in a private data center that cannot accept inbound connections, how should you connect SecOps?

• A. Create a forwarder; run the integration instance on the forwarder.
• B. Query the enrichment source and upload results manually.
• C. Create a network route from Google Cloud to the data center.
• D. Create a remote agent in the private data center and run the integration instance on the remote agent in SecOps.

Answer: (D)

When the enrichment technology sits in a private data center that cannot accept inbound connections, the connection must be initiated from inside the data center. The best way is to deploy a remote agent inside that private data center and run the SecOps integration on that remote agent. This creates an outbound-only path: SecOps communicates with the remote agent, the agent talks to the enrichment source within the data center, and results flow back through the same outbound channel. This setup satisfies the no inbound-connection constraint while keeping the integration within the trusted boundary of the private data center.

Why this fits best: it avoids exposing any inbound ports to the outside, uses a secure bridge inside your network, and keeps the enrichment processing aligned with SecOps through an agent that you control inside the data center. The other approaches either require opening inbound paths, rely on manual, non-automated workflows, or introduce direct connectivity that violates the constraint.