Which change reduces false positives when a detection rule triggers on Cloud Storage enumeration by automation?

• A. Add principal.user.email != "[e-mail]" to exclude the automation account.
• B. Replace api.operation with api.service_name = "storage.googleapis.com".
• C. Convert the rule into a multi-event rule for repeated calls across buckets.
• D. Adjust the rule severity to LOW.

Answer: (A)

Excluding a known automation account from the alert is the most effective way to cut false positives in this scenario. When automation performs Cloud Storage enumeration, the activity is legitimate for that account, and many detection rules can flag it as suspicious simply because it looks like inventory or enumeration activity. By adding a filter that excludes the automation account’s principal (for example, its service account email), you prevent those routine, authorized calls from triggering the alert, keeping the rule focused on genuinely anomalous or unauthorized activity from non-approved principals.

The other approaches don’t specifically address the root cause of the noise. Using a broader service name filter doesn’t distinguish between automated and human activity. Converting to a multi-event rule changes how events are correlated but doesn’t filter out the benign automated calls. Lowering the severity doesn’t reduce the number of alerts, it only changes how they’re prioritized.