SPLK-5001 › Investigation And Risk Management

Investigation And Risk Management Practice Questions

This domain covers Splunk Enterprise Security investigation workflows and the Risk Framework: how risk rules, risk index retention, risk scores, and notable events fit together. Questions are scenario-based, asking where a specific setting lives or which ES UI, configuration file, or search returns the contributing risk events behind a notable.