Security Operations & Threat Intelligence | Google Gemini

Key Takeaways

[Music] hi my name is Sandy wendzel and I'm a regional security architect for Google Cloud security and today I'm going to walk you through our Google SEC Ops platform and how Gemini is going to be a game changer for analysts to help produce toil our first screen here is all of our sore Playbook cases and what it's doing is it actually grouped together the events and alerts based on causality and how things are going next we're going to see our first interaction with AI where it's actually showing a summary of what happened based on the entities and events it's giving you more detailed view of what actually happened and where and where the source was and then the third part is next steps you should take so how you should actually mitigate it and what further things that we want to look at based on that information we can then have pending actions for playbooks to either stop that instance clone that instance if we think it's a false positive or use it for further risk and behavior based on the machine and the entity our next we're going to actually ask Gemini to pull up here things about our environment and again this is within our environment using our own log sources this is very catered and boutique to you as the customer the first thing we asked was am I impacted by ap43 what Gemini came back with was here's some information about ap43 there's some attribution and we actually found two indicators within your environment we then asked the follow-up question about you know can we run a search to investigate this or what were those processes that were involved and it actually came back with an output to show us the sysmon and the hash now from here not being a udm expert for understanding of the search I can run a search to help investigate with the click of a button and as you see it actually pre-populated my udm search with the appropriate fields and gave me more uh contextual evidence on what I need to know so with that this is our demino of Gemini and how we are with Google security operations and make sure you click the link below for more information [Music]