Which integration step best supports GTI-based enrichment when coordinating detection across on-prem and cloud environments?

• A. Ingest GTI IOCs into SecOps as events.
• B. Ingest on-prem and cloud security logs into SecOps SIEM as events.
• C. Ingest on-prem/cloud logs into SIEM as entities.
• D. Use SOAR integrations with GTI for event enrichment.

Answer: (D)

Enrichment is most effective when it happens as part of the event workflow so detections across environments can be augmented in real time with threat intelligence and automatically acted on. Using SOAR integrations with GTI for event enrichment enables automatic GTI lookups and annotation right as events flow from both on-prem and cloud sources, allowing consistent, cross-environment context and faster responses.

Ingesting GTI IOCs as separate events doesn’t attach the intelligence to the original detections, so analysts lose the immediate context. Ingesting on-prem and cloud logs as events is about bringing data into the system but doesn’t inherently enrich those events with GTI data. Ingesting logs as entities focuses on asset context rather than enriching each event with threat intelligence. The SOAR GTI integration ties enrichment directly to the detections, across environments, making it the best fit.