Which action augments SCC with additional detectors using known IOCs and external signals?

• A. ETD custom module using Configurable Bad IP template.
• B. SHA custom module using compute address resource.
• C. Custom posture combining prebuilt ETD and SHA detectors.
• D. Custom log sink with threat intel IPs and use SCC API to generate findings.

Answer: (A)

The main idea is to extend detection capabilities by adding a detector that can consume known indicators of compromise and external threat signals. The ETD custom module with a Configurable Bad IP template provides a concrete way to inject your IOC list—such as known bad IPs from threat intel—into an endpoint threat detector. By wiring in those external signals through the template, the detector can actively monitor for and raise alerts when those IPs appear in endpoint activity, effectively expanding SCC’s detection coverage with your intel.

The other options don’t deliver this same IOC-driven augmentation. A custom module for Security Health Analytics focused on compute addresses isn’t about adding new IOC-based detectors. A custom posture that simply combines prebuilt ETD and SHA detectors still relies on existing analytics rather than introducing new IOC-based rules. A custom log sink with threat intel IPs and using the SCC API to generate findings pushes information into SCC but doesn’t enlarge or customize the detectors themselves to act on those indicators.