To identify all potential GTI IOCs within your organization's data using SecOps, which page should you use?

• A. Use the Cases page.
• B. Create YARA-L rules to detect and alert when GTI identifies threats.
• C. Use Gemini to search threats.
• D. Use the Alerts & IOCs page in SecOps.

Answer: (D)

Viewing GTI IOCs in SecOps is most effective on the Alerts & IOCs page because it brings together indicators of compromise from threat intelligence with the alerts your environment generates, giving you a single, searchable view of all potential GTI IOCs across your data. This page is designed to surface GTI-derived indicators alongside active alerts so you can quickly correlate threats, investigate, and take action. The Cases page handles incident case management, not the discovery of IOCs. Creating YARA-L rules adds detection logic but isn’t a centralized place to identify GTI IOCs across your data. Gemini is a threat-search tool for exploring threat intel, not the SecOps view that aggregates GTI IOCs with your alerts. So, the Alerts & IOCs page is the correct place to identify all potential GTI IOCs within your data.