You need to identify the top 5 source IPs that have triggered the most 'failed_login' events in the last 24 hours. Which command sequence should you use?
You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?
You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?
You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?
A SOC analyst is investigating a possible brute-force attack. They run `index=security sourcetype=linux_secure action=failure` and see thousands of results. They need to produce a single report showing the number of failed login attempts per source IP, sorted with the most active source at the top. Which SPL search should they use?
A security analyst is investigating a potential data exfiltration. They need to identify all outbound connections where the total bytes transferred exceeded 10 MB within a 5-minute window for each source-destination pair. Which SPL command sequence correctly calculates this?
A security analyst is building a search to detect potential data exfiltration by identifying users who have transferred more than 1 GB of data to external IP addresses. The events contain fields 'user', 'bytes_out', and 'dest_ip'. The analyst wants to use the 'eval' command to create a new field 'is_external' that flags external IPs, and then aggregate total bytes per user. Which two SPL commands or functions are essential to achieve this? (Choose two.)
A security analyst needs to correlate failed login attempts with subsequent successful logins from the same source IP within a 10-minute window. The search must return only events where a successful login occurs after at least three failed attempts from the same src_ip. Which SPL command sequence best accomplishes this?
An analyst is building a search that must calculate the time between a user's login and their subsequent logout. The events have a user field and a timestamp, and the events are of type login and logout. Which SPL approach correctly calculates the session duration per user?
An analyst needs to correlate web proxy logs with firewall logs to identify internal hosts that accessed a known-malicious domain and also had outbound connections blocked. The proxy logs have fields src_ip and dest_domain; the firewall logs have src_ip and action. Which SPL construct best allows joining these two datasets on src_ip while preserving all matching events from both?
A SOC analyst is building a search to surface hosts whose outbound byte volume to external destinations is unusually high. The search must aggregate total bytes sent per src_ip, restrict results to private source addresses, and only return hosts exceeding a defined threshold. Which TWO SPL constructs correctly enforce the private-address filter and the threshold condition within this pipeline? (Choose two.)
An analyst needs to correlate two event types: 'authentication' events containing a field 'session_id' and 'process' events also containing 'session_id'. The goal is to display all fields from both event types where the session_id matches, preserving events from both sides even if one side has no match. Which SPL command should be used?
A security analyst is investigating a potential data exfiltration incident and needs to identify anomalous outbound traffic volumes. The analyst wants to calculate the standard deviation of bytes transferred per destination IP over the last 24 hours and flag any destination where the total bytes exceed the mean plus two standard deviations. Which two SPL commands are essential to compute the required statistics? (Choose two.)
A security analyst is building a search to detect anomalous process executions on endpoints. They need to compare the current hour's process count per host against the average process count for that host over the past 7 days, and alert if the current count exceeds the average by more than 3 standard deviations. Which SPL construct is most appropriate for this statistical comparison?
A security analyst wants to extract the domain from a URL field named 'url' in web proxy logs. The URL format is 'https://sub.example.com/path'. Which SPL command correctly extracts 'example.com' into a new field called 'domain'?
A security analyst needs to create a search that returns events from the 'index=firewall' where the 'action' field is 'blocked', and then displays only the 'src_ip', 'dest_ip', and 'dest_port' fields, with the 'dest_port' renamed to 'port'. Which SPL search accomplishes this?
A detection engineer needs to enrich firewall events with an asset-owner lookup table that maps ip to owner. Some events have an ip value that is not present in the lookup. The requirement is to keep ALL firewall events in the results, showing the owner when it exists and leaving it null when it does not. Which SPL search satisfies this?
A threat hunter is analyzing DNS logs and wants to identify domains that exhibit characteristics of domain generation algorithms (DGA). Which two SPL techniques are most effective for surfacing potential DGA domains? (Choose two.)
A SOC analyst is investigating a potential data exfiltration incident. They need to identify events where the 'bytes_out' field is greater than 1,000,000 and the 'dest_country' is not 'US'. Which SPL search correctly filters these events?
A security analyst is reviewing firewall logs and needs to calculate the ratio of inbound to outbound traffic for each destination IP. The logs contain separate events for inbound and outbound traffic, with a field 'direction' indicating 'in' or 'out' and a field 'bytes' indicating the size. Which SPL search will produce a table showing each destination IP with its inbound bytes, outbound bytes, and the ratio of inbound to outbound?
A SOC analyst wants to create a search that returns events from the 'firewall' index where the action field is 'blocked' and the src_ip is not in a known whitelist of internal IPs. The whitelist is stored in a CSV lookup named 'internal_ips.csv' with a field 'ip'. Which SPL search correctly excludes events from whitelisted IPs?
An analyst needs to identify periods of unusually high login failures for a specific user account. They want to calculate the standard deviation of the number of failed logins per hour over the past week and flag hours where the count exceeds two standard deviations above the mean. Which SPL command sequence accomplishes this?
A SOC analyst needs to identify which user accounts have the highest number of failed login attempts in the `auth` index over the past 24 hours. The failed login events contain the field `user`. The analyst runs a search that returns the top 10 users by failed login count. Which SPL command should be used to sort the results in descending order by the count and then limit the results to the top 10?
A security analyst is investigating a potential data exfiltration attempt. They have a search that returns events with fields `src_ip`, `dest_ip`, `bytes_out`, and `action`. They need to identify source IPs that have transferred more than 1 GB of data to external destinations, but only for events where the action is 'allowed'. They also want to include the total bytes transferred per source IP and sort the results in descending order. Which two SPL commands are required to achieve this? (Choose two.)
A security analyst wants to create a search that returns events from the `firewall` index where the `action` field is either 'blocked' or 'denied'. The analyst also wants to ensure that the search only looks at events from the last 7 days. Which search string correctly achieves this?
You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?
An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?
A security analyst needs to identify all Windows event codes where the count of events exceeds 100 in the last 24 hours, and then display the results sorted by count in descending order. The base search returns events with the field 'EventCode'. Which SPL search accomplishes this?
A security analyst needs to identify the percentage of total authentication events that each user account generated over the past week. The search must return the user, the count of events for that user, and the percentage each user represents of all authentication events, sorted so the largest share appears first. Which SPL search accomplishes this?
A security analyst needs to correlate two event types for the same user within a 10-minute window: a 'login' event and a subsequent 'privilege_escalation' event. The events share a common field 'user'. Which SPL command should be used to join these events based on the user and time proximity?
A security analyst wants to correlate login and logout events for each user to calculate session durations. The events have fields 'user', 'action' (login or logout), and '_time'. Which SPL command sequence is most efficient to pair each login with the subsequent logout for the same user?
A defense analyst wants to correlate proxy logs and firewall logs to find internal hosts that contacted a known-malicious domain. The proxy logs store the field dest_host and the firewall logs store the field fqdn, and both indexes contain a common field src_ip. The analyst wants a single result set showing src_ip values present in both data sources for the same domain. Which SPL approach returns only hosts seen in both logs for matching domains?
A security analyst wants to identify which users have logged in from more than one distinct country in the last 24 hours, a possible sign of credential compromise. The events contain user and src_country fields. Which SPL search best identifies these users?
An analyst is triaging a suspected brute-force attack and needs to view raw event text alongside a computed field showing how many seconds elapsed between consecutive failed logins from the same source IP. The events must remain individually visible, in time order, with the delta shown per event. Which SPL search best meets this need?
A security analyst needs to quickly identify which users have logged in from more than three distinct source IP addresses in the last 24 hours. Which SPL command correctly calculates the number of distinct source IPs per user?
A security analyst is investigating a potential insider threat and needs to see the number of events per hour for a specific user over the past 48 hours. The events are in the 'index=insider' with a field 'user'. Which SPL search will produce a time chart showing hourly event counts for that user?
A security analyst is investigating a potential data exfiltration event. They need to calculate the rate of outbound data transfer per source IP over the last 30 minutes, but the raw logs only contain cumulative byte counts per connection. Which SPL command sequence correctly computes the per-second rate of change for each src_ip?
A threat hunter wants to enrich firewall events with asset ownership data stored in a CSV lookup named asset_owners.csv, which maps dest_ip to owner and department. The lookup is already defined in transforms.conf. The hunter needs the owner and department fields added to each event. Which SPL search accomplishes this?
A security analyst wants to extract the domain from a URL field in proxy logs to identify the most frequently accessed domains. The URL field contains values like 'https://www.example.com/path/page.html'. Which SPL command and function should the analyst use to extract just the domain?
A security analyst is writing SPL searches to detect suspicious activity and wants to understand which commands can be used to filter or transform search results. Which TWO of the following statements about SPL commands are accurate? (Choose two.)
A security analyst needs to create a search that identifies users who have logged in from more than three distinct countries within the last 24 hours, which could indicate compromised credentials. The authentication logs contain 'user' and 'src_country' fields. Which SPL search correctly identifies these users?
A security analyst is building a search to identify brute force attacks. They want to use the 'stats' command to calculate the count of failed login attempts per source IP, and then filter for IPs with more than 10 failures. They also want to include the earliest and latest timestamps of these failures. Which two SPL commands or functions should be used to achieve this? (Choose two.)