When suspecting lateral movement from a development GKE cluster to production, which initial action helps identify IOCs and prioritize investigation before deep raw log analysis?

• A. In the SCC console, apply filters for the cluster and analyze aggregated findings timeline/details for IOCs; examine attack path simulations and exposure scores.
• B. Review threat intel feeds in SecOps and enrich anomalies.
• C. Investigate VM Threat Detection findings for cluster nodes.
• D. Create a SOAR playbook to isolate GKE resources with unusual connections.

Answer: (A)

In this scenario, the fastest, most actionable approach is to perform triage using centralized security telemetry to surface indicators of compromise and rank where to investigate first. Using Google Cloud Security Command Center, you can filter to the suspect GKE cluster and review aggregated findings, timelines, and event details for IOCs. This lets you see correlated signals, such as unusual configurations, suspicious network activity, or known exploit indicators, without wading through raw logs immediately. Attack path simulations illuminate how an attacker could move from the development cluster toward production, highlighting exposed surfaces and potential lateral movement routes. Exposure scores then prioritize findings by risk, so you focus on the most critical items first. This combination provides a high-value, environment-specific view to guide deeper analysis efficiently.

Threat intel feeds can enrich anomalies, but they don’t provide the immediate, cluster-specific signal needed for quick triage. VM Threat Detection looks at the VM layer, which may miss container-level indicators within a GKE environment. A SOAR playbook to isolate resources is a valuable response step, but it’s most effective after you’ve identified and prioritized IOC signals during initial triage.