Which approach helps you identify all GTI threats within your data by using SecOps?

• A. Cases page
• B. YARA-L rules
• C. Gemini
• D. Alerts & IOCs page

Answer: (D)

GTI threats are identified by indicators of compromise (IOCs) from threat intelligence and then matched against your telemetry to see where those threats appear in your environment. The Alerts & IOCs page is built for this purpose: it centralizes GTI indicators and ties them to real data in your environment, so you can search, correlate, and surface alerts when those indicators show up. This gives you a comprehensive view of known threats across all your data sources.

The other options serve different workflows. The cases page is about managing investigations after something is found, not about proactively identifying threats. YARA-L rules are detection signatures you deploy to catch specific patterns, but they’re narrow in scope and require ongoing rule creation and maintenance. Gemini is another threat-intelligence tool, but it doesn’t provide the same integrated, all-data GTI threat view that the Alerts & IOCs page offers.