To proactively identify novel/emerging attack patterns targeting Google Cloud in near real-time, which configuration should you implement? (Variant)

• A. Configure an Applied Threat Intelligence Fusion Feed in SecOps and develop YARA-L rules to search ingested telemetry.
• B. Use built-in ETD threat intelligence in SCCE.
• C. Route logs to BigQuery and scheduled queries with open-source threat intel feeds.
• D. Use Cloud Armor WAF rule sets and Adaptive Protection with GTI.

Answer: (A)

Proactively spotting new and emerging attack patterns in near real time hinges on getting fresh threat signals into your security operations and applying flexible, rapid-to-change detection rules to the incoming telemetry. The Applied Threat Intelligence Fusion Feed gathers threat intel from multiple sources and surfaces it inside SecOps in a unified feed. Pairing that with YARA-L rules lets you write expressive patterns that scan ingested telemetry for indicators of compromise, tactics, techniques, and procedures as they appear. This combination enables analysts to detect novel patterns as soon as they show up in logs and events, without waiting for a predefined alert library to catch up.

The other options don’t align as well with near-real-time discovery of novel patterns. Built-in ETD threat intelligence in SCCE is useful, but it tends to rely on preconfigured signals and may not adapt rapidly to new, emerging patterns. Routing logs to BigQuery with scheduled queries and open-source feeds can help surface intel, but the reliance on scheduled processing introduces latency and may miss the instant, streaming detection needed for novel attacks. Cloud Armor WAF rules and Adaptive Protection guard web traffic and provide protection signals, but they’re oriented toward defense at the edge rather than broad, real-time detection across diverse cloud telemetry for new attack patterns.