Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) (SPLK-5001) — Questions 76–150

The CIM normalises destination address fields across disparate data sources into the standard dest field, enabling consistent correlation regardless of vendor naming. This directly satisfies the stem's requirement for a standard field identifying the destination IP address.

This stats command correctly calculates the count of failed logins per source IP and also captures the earliest and latest timestamps using min(_time) and max(_time). The 'by src_ip' clause groups the results by source IP. This directly provides the required aggregation and time range information, making it a correct component of the solution for identifying brute force attacks.

Event ID 4769 logs Kerberos service ticket requests. TicketEncryptionType 0x17 indicates RC4, which is weak and commonly requested by Kerberoasting tools. Excluding machine accounts ending in $ focuses on user accounts, which are the typical targets for offline password cracking.

outputlookup writes search results back to a lookup file, overwriting or appending to the named CSV. This lets newly discovered IOCs from the current search persist into ioc_list.csv for enrichment in later searches, satisfying the dynamic update requirement.

The Network_Resolution data model normalizes DNS query and response data, including the query string and record type. By analyzing the query field for unusually long or high-entropy subdomains and counting unique queries per host, analysts can detect DNS tunneling patterns where data is encoded in subdomain labels.

Network Traffic is the CIM data model that normalises network connection events, including source and destination IP addresses, ports, and domain names. It captures the outbound connection from the system process to the suspicious external domain, satisfying the stem's requirement for network connection information.

Using `bin _time span=1d` rounds each event's timestamp down to the nearest 24-hour boundary, producing discrete daily buckets rather than rolling windows. This satisfies the stem's requirement by collapsing raw timestamps into fixed one-day groups, enabling per-day aggregation such as counts or averages across each calendar day.

The Correlation Search Editor creates and schedules correlation searches, letting you supply a custom blacklist lookup of domains and define the triggering logic. This directly satisfies the requirement to build a new correlation rule from your own domain list rather than a built-in content source.

Mapping sources to the Splunk Common Information Model normalises disparate field names and formats into a shared schema, letting searches and correlations run consistently across heterogeneous data. This directly satisfies the stem's accuracy constraint, since unnormalised fields would cause missed or mismatched events during the hunt.

Severity is one of the two metrics displayed in the Notable Event list, satisfying the dashboard's requirement to surface prioritisation data for triage. Each notable event row shows its severity alongside the event name, letting analysts rank incidents by urgency directly within the Incident Review dashboard.

The Endpoint data model normalises process telemetry into fields such as process_name and process_path, letting you compare running process names against known good executable paths to expose masquerading. This directly satisfies the stem's requirement to detect a renamed system process hiding in plain sight.

Status management lets analysts assign, track and update notable event states such as New, In Progress and Closed directly within Incident Review, satisfying the stem's requirement for features the dashboard provides rather than external workflow tooling.

A lookup definition allows the correlation search to reference the CSV file as a lookup table. By using the lookup command, the search can match the source IP against the list and filter out known internal IPs. This is the standard method in Splunk ES for incorporating external lists into correlation searches, enabling dynamic updates without editing the search itself.

Data model acceleration is required to precompute results and improve search performance. Without acceleration, the data model is not materialized, and searches run against raw data, leading to slower performance. Enabling acceleration on the data model allows the correlation search to leverage the precomputed summaries, significantly reducing search time.

Asset and identity lookups enrich raw events with ownership, priority and behavioural context, letting correlation searches and risk scoring distinguish critical systems from noise. Without this contextual data, ES cannot meaningfully prioritise or attribute the activity it detects, so insights remain shallow.

The 'user' field identifies the account being targeted. If it is a service account, misconfiguration is likely; if it is a regular user or many different users, brute-force is more probable. Examining the user helps distinguish between an attack and an operational issue, making it the most relevant field for this differentiation.

Retention for indexes is configured through the Index Manager interface, which exposes per-index settings including the default retention period. Editing the 'risk' index there changes its retention directly, satisfying the requirement to modify the default.

The Correlation Search Editor exposes the risk score threshold directly, letting you raise or lower the sensitivity assigned to a specific correlation search. Editing the search's risk configuration there satisfies the stem's requirement to adjust that individual search, rather than changing global risk settings or the underlying saved search definition.

Risk Analysis aggregates risk attributed to entities such as users and systems, letting you correlate many disparate events across extended timeframes into a cumulative risk score. That long-duration, entity-centric correlation is exactly what the insider-threat exfiltration scenario requires.

Risk scores are derived from risk events currently retained in the risk index. If some contributing events have aged out due to retention limits, they no longer contribute to the score. This is the most likely reason the total is lower than expected when summing all rule weights the analyst believes should apply. The scoring window and index retention directly bound which events count.

A lookup returns fields only for events whose key value matches an entry in the lookup table. Events lacking a match keep null values in the enriched fields rather than being dropped or erroring, satisfying the scenario where the common field is absent from the lookup file.

Correlation search suppression configures a search to stop generating notable events for defined conditions, such as a maintenance window or known benign pattern. It prevents unwanted notables at generation time, satisfying the stem's requirement for a suppression method.

Consistent source data ensures enrichment lookups resolve reliably, since Splunk correlates assets and identities by matching field values across lookups. Inconsistent naming, formatting or missing identifiers cause failed joins, producing incomplete or inaccurate enrichment. This directly satisfies the stem's requirement for effective Asset and Identity enrichment, where trustworthy, uniform source files underpin every correlation search.

The Endpoint data model contains process execution, file system changes, and registry modifications. It can reveal the ransomware process, its parent process, and any dropped files, which helps trace back to the initial infection vector, such as a malicious document or exploit. This is essential for understanding how the ransomware executed.

Dollar-sign tokens substitute field values from the triggering event into the drilldown URL at render time, letting the target page receive the exact field content. This is the documented token syntax for notable event drilldowns.

The 'Recover' function requires documenting how incidents are resolved and lessons captured. The Incident Review dashboard records investigation findings, resolution steps and post-incident notes, providing the audit trail needed to evidence recovery activities against NIST CSF requirements.

The Respond function includes the Response Planning category, which ensures that response processes and procedures are executed and maintained. This directly supports the team's goal of having predefined procedures to respond to incidents. By focusing on RS.RP, they can develop, test, and update response plans, ensuring effective incident handling.

Urgency in Splunk ES is calculated from the notable event's risk score, which aggregates risk from contributing risk objects and anomaly detections. A higher risk score directly raises urgency, so this factor satisfies the stem's requirement for a direct input to the urgency calculation.

Malware commonly beacons to command-and-control infrastructure, so an unusual outbound network connection from a host to unfamiliar external addresses is a recognised infection indicator. It reflects unauthorised communication consistent with the stem's malware compromise scenario.

Lookback windows are sized to match attacker dwell time, the interval between initial compromise and detection. Hunting over that retrospective period surfaces evidence of intrusions that evaded real-time alerting, satisfying the requirement to uncover stealthy, long-resident threats rather than only current activity.

Case Management tracks an incident through its full lifecycle, holding status, owner, priority and assignment details, and linking the contributing notables together so analysts can update and hand off investigations rather than working from the Incident Review dashboard alone.

The Web data model in Splunk ES is designed to capture web activity, including HTTP requests and URLs accessed. By searching the Web data model for the malicious URL, the analyst can identify all users who accessed it, along with timestamps and source IPs. This directly answers the question of who clicked the link and provides the associated URLs, enabling rapid scoping of the incident.

EventCode 10 records process access, capturing one process opening a handle to another with granted access rights. Memory access to lsass.exe by a non-standard process appears here, making it the primary Sysmon event for credential-dumping detection.

The CIM Validator app inspects indexed events against a selected data model and reports which fields fail to map, exposing missing or misnamed CIM fields. This satisfies the stem's efficiency requirement by diagnosing mapping gaps before any manual field extraction work.

The Malware data model in the Common Information Model is specifically designed for malware detection events, including infections, quarantines, and cleanups. Mapping endpoint protection logs to this data model ensures that the events are normalized and available for correlation searches and dashboards that rely on malware data. This is the correct data model for the scenario.

The Geographic Information dashboard plots source IP addresses onto a world map using geolocation lookups, directly satisfying the requirement to visualise the geographic origin of incoming connection attempts. Other dashboards present traffic volumes or protocol breakdowns without geographic context.

The `if()` function evaluates the condition `status>400` and returns 1 when true, 0 otherwise, assigning the result to the new field `is_error`. This satisfies the stem's requirement for a valid `eval` use, since `eval` creates or overwrites fields using expressions, and `if()` is a supported evaluation function.

Actions on Objectives is the final phase of the Cyber Kill Chain, where the adversary achieves their goal, such as data exfiltration, data destruction, or disruption. The scenario shows large outbound transfers to an external IP, indicating data theft, which is a classic objective. This phase directly matches the observed activity.

The Risk Analysis adaptive response action writes and reads risk scores through the Risk Data Model, which stores risk objects, scores and annotations. Enrichment of events with calculated risk context therefore depends on that model's fields, satisfying the stem's requirement for the data model the action relies upon.

The stats command's stdev function computes the sample standard deviation of response_time, and the by clause splits results per server. This satisfies the per-server grouping constraint, producing one std_dev value for each distinct server in the result set.

The 'notable' index stores events generated when correlation searches trigger, revealing whether the search fired and what it produced. Inspecting it confirms detection, timestamps and field values, satisfying the need to verify whether a malfunctioning search executed at all before investigating its underlying SPL logic.

Risk Message is a configurable field within the Risk Analysis adaptive response action, letting analysts attach a descriptive annotation to the risk event. This satisfies the stem by naming one of the three settings the action exposes.

The Threat Intelligence Manager dashboard in Splunk Enterprise Security lists configured intelligence sources and lets analysts review, enable, or disable feeds. It is the designated interface for managing active threat intelligence feeds, matching the question's requirement precisely.

The Endpoint data model includes a dll_path field for events related to DLL loading (e.g., from Sysmon Event ID 7). This field specifies the full path of the loaded DLL. In DLL sideloading, attackers place a malicious DLL in a directory where a legitimate application loads it, often from an unusual path. Monitoring dll_path for anomalies helps detect such attacks.

Risk-based detections must produce risk events that specify which entity the risk applies to and the score contribution. Without a risk object and a risk score value, the event cannot be attributed to an entity or affect its risk profile. This is the core mechanism by which a detection feeds the risk framework rather than only generating a standalone notable.

Event ID 4698 is logged when a scheduled task is created. The TaskContent field contains the XML definition of the task, including the action's executable path. Filtering for suspicious paths or binaries in TaskContent directly detects malicious scheduled task persistence.

The MITRE ATT&CK Dashboard in Splunk ES provides a visual mapping of detections to ATT&CK techniques. Analysts can filter by tactic or technique, such as Credential Dumping (T1003), to see which correlation searches are associated. This allows the team to quickly identify active detections that can detect credential dumping behavior, making it the appropriate feature for this scenario.

Adaptive Response actions execute through the specific add-on managing that device, so its configuration supplies the connectivity and credentials used for remote execution. Checking these first satisfies the stem's requirement to verify the action's own transport and authentication path before investigating broader platform or network issues.

The alert action settings determine what happens when the search triggers. For notable events to appear in Incident Review, the search must have the 'Notable' alert action enabled and properly configured. If this action is missing or misconfigured, the search results will not generate notables, even if the search runs successfully. This is the first thing to verify.

Actions on Objectives is the final phase of the Cyber Kill Chain, where the attacker accomplishes their goal, such as data exfiltration, data destruction, or disruption. The large data transfer from an internal database to an external IP directly indicates exfiltration, which falls under Actions on Objectives. This is the correct phase to classify this activity.

The Asset & Identity Framework in Splunk ES allows analysts to centrally manage and correlate information about assets (e.g., servers, endpoints) and identities (e.g., users). It includes details such as user roles, privileges, and associated assets. By using this framework, the analyst can quickly see all assets and identities linked to the compromised user, assess their privileges, and evaluate lateral movement risks. This makes it the appropriate feature for this scenario.

The commonly used intelligence tier model separates strategic intelligence for executives, operational intelligence about campaigns and actor intent, tactical intelligence such as TTPs, and technical intelligence like IPs, domains, and file hashes. This directly matches the lead's need to label feeds as raw observables, contextual reporting, or confirmed malicious indicators.

The Event Details panel in Incident Review shows the notable event's fields, including the correlation search name, risk objects, risk scores, and other metadata. It is the primary place to see why a notable was generated and which entities contributed risk. This directly answers the analyst's need to identify the generating search and risk objects without running additional searches.

Pretexting fabricates a scenario or identity to manipulate a target into divulging information or performing actions, exploiting trust rather than technical flaws. It is a recognised social engineering category, satisfying the stem's requirement for common human-focused manipulation techniques.

EventCode 4769 records Kerberos service ticket requests, and computing distinct service names per account establishes the breadth baseline. Eventstats lets you attach the historical average to each current event so you can flag accounts whose current-hour SPN diversity far exceeds their norm. That directly isolates abnormal service-ticket breadth consistent with kerberoasting reconnaissance or service account abuse.

Adjusting the risk score value for a risk rule directly controls the contribution of each risk event to an object's total risk score. Lowering this value reduces the rule's influence without disabling it, which is ideal for mitigating alert fatigue while retaining visibility into the activity. This is the intended method for tuning risk rules in Splunk Enterprise Security.

The Endpoint data model normalises process-execution telemetry, including PowerShell command lines and script-block logging, into fields such as process and process_name. This directly satisfies the stem's constraint of searching obfuscated, encoded PowerShell activity, since the encoded command string is captured in the process command-line field rather than in network or authentication data.

The search executes successfully but matches nothing, so the correlation search's filtering logic, such as field names, thresholds or time windows, does not correspond to the indexed data. Correcting the search logic to match actual field values should produce risk events.

Reconnaissance is the first phase of the Cyber Kill Chain, covering the attacker's research and target selection before any exploitation occurs. It satisfies the stem's requirement for a commonly defined phase, alongside Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.

The risk score assigned to a risk rule determines how much risk is added to the associated risk objects. A score that reflects severity and confidence ensures that high-fidelity detections contribute more risk, while low-confidence ones contribute less. This is a key part of RBA configuration because it directly influences when risk thresholds are crossed and notables are generated. It also helps prioritize investigations based on aggregated risk.

Combosquatting creates malicious domains by adding words to a legitimate brand name, such as 'microsoft.com.security-check.net' or 'office365.com.auth-verify.org'. The extra words make the domain appear trustworthy to users and sometimes to simple filters. The repeated resolution of such lookalike domains immediately before outbound HTTPS connections is a strong indicator of this technique used for phishing, malware delivery, or command-and-control.

The correlation search defines a risk factor, and each notable event it generates inherits that value as its Risk Score. This satisfies the question by identifying the configured risk factor, not the event severity or asset criticality, as the origin.

Sandbox and reputation services detonate or query the hash against external intelligence, providing independent confirmation of maliciousness. This satisfies the stem's verification requirement, since Splunk ES internal data alone cannot confirm a hash is truly malicious.

Because ATT&CK enumerates observable techniques, teams can overlay their detection content and see which techniques lack coverage. This coverage-gap analysis is a core ATT&CK use case and is not a native capability of the Cyber Kill Chain, whose seven phases are too coarse to reveal granular detection shortfalls.

Splunk Case Management groups related notables, events and artefacts into a single investigation container, preserving shared context, ownership and status. This directly satisfies the need to consolidate related notables, which standalone correlation searches or dashboards cannot do.

Incident Review lists all notable events with their urgency, status, owner and disposition, giving analysts a consolidated queue of active investigations. This satisfies the stem's requirement for a summary of notable events currently requiring investigation.

Weaponization is the phase where the adversary creates the attack vector, such as coupling an exploit with a deliverable payload. Embedding a macro in a document is a classic weaponization step. In Splunk ES, detections for this phase are challenging because it occurs on adversary infrastructure, but threat intelligence can provide indicators of known weaponized files.

Domain footprinting gathers DNS, WHOIS and registration data to map an organisation's external attack surface before exploitation. It satisfies the stem's reconnaissance criterion because it is passive information gathering, occurring prior to any intrusion attempt.

This search filters successful logins in the last 24 hours, then uses stats with the distinct count function dc on src_country grouped by user. The where clause keeps only users whose distinct country count exceeds one. This directly surfaces users who authenticated from multiple countries, matching the analyst's requirement.

Persistence is the ATT&CK tactic that covers techniques adversaries use to keep access to systems across restarts, changed credentials, and other interruptions. The team should map detections for registry run keys, scheduled tasks, and services to this tactic. Splunk ES includes correlation searches aligned to Persistence so analysts can quickly surface suspicious autorun modifications.

Excluding known administrative processes with 'NOT' clauses directly suppresses benign activity that would otherwise trigger detections, satisfying the requirement to reduce false-positive noise during hunting. Filtering trusted executables at search time narrows results to genuinely suspicious events, so analysts spend less effort triaging routine administrative behaviour.

OR is a valid Splunk search operator, combining results from two search terms so that events matching either term are returned. It satisfies the stem's requirement for a genuine search operator, unlike comparison symbols or wildcards used within terms. OR works across the main search, subsearches and eval expressions.

The lookup command matches event fields against an external KV Store collection holding indicators, appending threat context such as severity or category to each event. This satisfies the enrichment requirement without indexing new data, since the intelligence is referenced at search time.

This sequence sorts events chronologically, then uses streamstats to capture the previous bytes and previous timestamp for each src_ip. The eval calculates the per-second rate of change between consecutive events, correctly handling cumulative byte counts and providing the rate needed to spot exfiltration spikes.

Brute Force is a technique under Credential Access (T1110). It involves adversaries attempting to gain access by systematically trying passwords or passphrases. This aligns with the scenario's need to identify Credential Access techniques, as it directly targets credential compromise.