Which change reduces false positives when a detection rule triggers on Cloud Storage object listing due to automation activity?

• A. Add principal.user.email != "[e-mail]" to exclude the automation account.
• B. Replace api.operation with api.service_name = "storage.googleapis.com".
• C. Convert the rule into a multi-event rule for repeated calls across buckets.
• D. Adjust the rule severity to LOW.

Answer: (A)

When tuning a detection rule that flags Cloud Storage object listing, filtering out benign automation activity is the most effective way to reduce false positives. Excluding the automation account by its user email means events coming from that account won't trigger the rule, so legitimate maintenance actions across buckets no longer contribute to alerts. This directly targets the source of noise and keeps the rule focused on unexpected or unauthorized activity from real users.

Changing the rule to look at a different field like the service name doesn’t specifically remove the automation’s activity; it might still alert on listings performed by automation or confuse signals across services. Making the rule multi-event could help with grouping related events but doesn’t filter out the automation account itself. Lowering the severity only shifts how alerts are prioritized, not whether the automation activity should trigger an alert in the first place.