Which method would you use to identify all assets a specific user interacted with over the past seven days in Google SecOps?

• A. Use Raw Log Scan view to group events by asset ID.
• B. Query for hostnames in UDM Search and filter results by user.
• C. Generate an ingestion report for sources where the user appeared.
• D. Run a retrohunt to find rule matches triggered by the user.

Answer: (B)

To identify all assets a specific user interacted with over the past seven days, you want to filter activity by that user and surface the assets involved. In Google SecOps, the right approach is to use UDM Search to query for hostnames and apply a filter for the user, then set the time window to the last seven days. The hostnames returned are the assets, so you get a direct list of every asset the user interacted with within that period.

This is the best approach because hostnames correspond to the actual assets, and filtering by the user and a specific time range yields a complete, asset-focused view of interactions. Other options don’t directly produce a clean, comprehensive list of assets tied to that user over the full seven-day window: scanning logs by asset ID without user context misses the user-specific angle; ingestion reports show where a user appeared but not a complete per-asset interaction history; retrohunt finds rule matches and is geared toward hunting patterns rather than compiling all asset interactions for a user.