You have third-party threat intelligence subscriptions and want to continuously compare DNS calls on endpoints to your feeds. What should you do?

• A. ETD custom modules in SCC correlating feeds with Cloud logs.
• B. Push endpoint logs to BigQuery; scripts compare entries to GTI API.
• C. Create a YARA-L rule in SecOps to track matches between ingested EDR logs and the entity graph.
• D. Create a YARA-L rule to track matches with VirusTotal table in entity graph.

Answer: (C)

The main idea is to perform in-platform, automated cross-source correlation by using detection rules that can compare endpoint telemetry with threat intel, all within the entity graph. Writing a YARA-L rule in SecOps lets you express how an endpoint event (like a DNS query or DNS resolution) should be considered a match when it aligns with indicators from your threat intel feeds that are already represented in the entity graph. As DNS activity streams in, the rule evaluates against the graph’s indicators and relationships, so you get real-time matches with rich context (which host, which domain, related assets, and related entities). This approach keeps detection centralized, scalable, and easy to update as feeds change.

Why this is the best fit: it leverages the integrated threat intel and entity graph to continuously and efficiently correlate endpoint events with indicators. It avoids external data exports or ad-hoc scripting, and it accommodates multiple feeds through the same graph-based detection mechanism. The other options either rely on separate pipelines or focus on a single feed (like VirusTotal) or external APIs, which adds latency and complexity and doesn’t provide the seamless, graph-backed correlation that YARA-L within SecOps offers.