Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) (SPLK-5001) — Questions 151–225

Eventstats calculates statistical measures across events without collapsing them. Computing standard deviation of query counts per host and flagging outliers identifies hosts generating abnormal DNS volume, which is a hallmark of tunneling. This method adapts to your environment's baseline and highlights deviations for further review.

The Splunk Add-on for Microsoft Windows ships the CIM-compliant field extractions and tags that map Windows Event Log data to the Authentication data model. Configuring the sourcetype within its input configuration ensures events are correctly tagged and aliased, satisfying the CIM conformance requirement.

The `lookup` command enriches events by matching field values against an external table, such as a threat intelligence CSV or KV Store collection. This directly satisfies the requirement to join threat intelligence data with local search results, appending indicators like IP reputation or file hashes to each matching event.

Risk-Based Alerting assigns and accumulates risk scores against users and entities, so activity from high-risk insiders rises above the notable threshold and triggers investigation, satisfying the requirement to mitigate insider threat. It correlates weak signals that individually would not alert.

Alert suppression allows you to suppress duplicate notables based on specified fields. Setting the suppression field to user and the period to 24 hours ensures that once a notable is generated for a user, subsequent triggers for that same user are suppressed for 24 hours, preventing duplicate notables. This directly meets the requirement.

Supplying only a lookup file and a single field is valid syntax: Splunk matches that field against the lookup's first column and, absent an OUTPUT clause, returns all remaining lookup fields automatically. This satisfies the basic lookup invocation form.

Search macros store a reusable search fragment, optionally with arguments, letting analysts parameterise values such as time ranges or entities and invoke the same logic across many searches. This directly satisfies the requirement to save, parameterise, and reuse a query.

DNS tunneling embeds data in subdomain labels, so the query names become far longer than typical hostnames. Extracting the query field with rex and measuring its length, then aggregating average length per query or per base domain, surfaces the statistical outlier pattern that characterizes encoded exfiltration traffic, making this a direct and effective hunting construct.

The risk_object_type field specifies the category of the risk object, such as user, system, or other. It is required so the framework knows how to interpret and store the risk event. Without it, the risk event may be discarded or misattributed, preventing accurate risk scoring.

With sum aggregation, each qualifying risk event contributes its own score, and the total for an object within the window is the arithmetic total of those individual event scores. This additive behaviour is precisely what the 'sum' method specifies, so overlapping events accumulate rather than being averaged or deduplicated.

In the Splunk Network_Traffic data model, the dns_query field holds the queried domain name from DNS request events. For DNS exfiltration, this field is essential to identify anomalous domains. Analysts pivot on dns_query to find high-entropy or long subdomains typical of data tunneling.

Sysmon Event ID 10 (ProcessAccess) logs when a process accesses another process, including access to LSASS memory. This is a primary data source for detecting credential dumping tools like Mimikatz that attempt to read LSASS memory. Enabling Sysmon with appropriate configuration provides the granular visibility needed to identify such techniques, making it critical for this scenario.

The Web data model normalises HTTP traffic, exposing fields such as http_user_agent and http_method that capture user-agents and request methods. It satisfies the stem's requirement to investigate web-based attacks by correlating proxy, IDS and web-server sourcetypes into a common schema.

The tstats command queries accelerated data models directly, returning results far faster than raw event searches across large indexes. The Endpoint data model's Processes dataset contains process execution details including command line and parent process, which is exactly what a PowerShell execution hunt needs. This is the standard accelerated approach for endpoint process hunting at scale.

The MITRE ATT&CK Dashboard in Splunk ES provides a visual representation of the ATT&CK matrix, showing which techniques have associated correlation searches and their status. It helps analysts and managers identify coverage gaps by highlighting tactics and techniques with no or few detections. This directly addresses the need to measure detection effectiveness against the framework.

The eval function base64_decode() converts a Base64-encoded string back to plaintext within a search, so the encoded PowerShell payload becomes readable. Applying it to the suspect field satisfies the stem's requirement to decode the string directly in Splunk.

Notable Event Suppression applies suppression rules that filter out notables matching known-benign criteria, such as expected scanner activity. This reduces alert fatigue from known false positives, satisfying the stem's requirement by preventing repetitive, low-value notables from reaching analysts.

The Web data model in Splunk ES is designed to capture web server activity, including HTTP request methods, URIs, user agents, and status codes. Examining this data model allows the analyst to pivot from the notable event to the specific HTTP request details, such as the URI and method used in the web shell exploit, providing crucial context for incident response.

The Asset and Identity framework enriches raw events with lookup-derived attributes such as owner, priority, and business unit. This enrichment supplies the contextual detail analysts need during investigations, satisfying the stem's requirement to provide context to events rather than merely correlating or filtering them.

The Network_Resolution data model captures DNS resolution events, including query names, query types, and response codes. It is specifically designed for analyzing DNS activity, making it the ideal choice for detecting DNS tunneling, which often involves abnormally long or encoded domain names. Searching this model allows the analyst to identify suspicious patterns.

Incident Review is the primary interface in Splunk Enterprise Security for investigating notables, providing access to the raw event, risk events, threat intelligence, and other contextual data via the Event Timeline and drill-down actions. It allows analysts to pivot seamlessly between the notable and related evidence, enabling efficient triage and investigation.

Aggregating EventCode 4688 by parent and child process directly surfaces wmiprvse.exe spawning shells such as cmd.exe or powershell.exe, satisfying the hunt's requirement to identify anomalous WMI process creation. The stats count by pair ranks frequency, letting you spot rare or unexpected parent-child combinations indicative of lateral movement.

The CIM Add-on normalises disparate source types by mapping their fields to the Common Information Model's unified schema, satisfying the stem's requirement for a single consistent data model across heterogeneous logs. It performs field aliasing and event tagging at search time, letting correlation searches reference standardised field names regardless of the originating sourcetype.

Detect is a NIST CSF Core function covering anomaly detection, continuous monitoring and detection processes. It is one of the five functions explicitly defined in the CSF Core, satisfying the stem's requirement for recognised components.

Risk score lifespan is governed by the decay settings within the Risk Analysis configuration in Enterprise Security settings, where the decay period and decay type define how scores age over time. Adjusting these values restores decay for the affected asset, satisfying the requirement that stale risk scores diminish rather than persist indefinitely.

The Identify function in NIST CSF 2.0 emphasizes understanding cybersecurity risks to systems, people, assets, data, and capabilities. Splunk ES's Asset and Identity framework allows organizations to centrally manage and correlate asset information, which is fundamental for identifying what needs protection and assessing risk. This directly supports the Identify function by providing a current inventory and context for critical assets.

Event ID 4104 captures PowerShell script block text. Searching for DownloadString and Invoke-Expression identifies common download-and-execute patterns used by attackers. This combination is specific to remote payload retrieval and execution, making it an effective hunt query.

The Endpoint data model's Processes node captures process access events, including the source process name and the target process, along with granted access masks. By correlating the source binary and the target lsass.exe, Splunk ES can surface suspicious access consistent with credential dumping, which is exactly the behavior described.

Access Anomalies correlates authentication failures with subsequent successful logins, directly surfacing the failed-then-successful pattern from a new source IP that the stem describes. It aggregates this behaviour per user and src, letting the analyst confirm brute-force activity without manual search construction.

Running the correlation search's query logic manually in the Search app isolates whether the underlying search returns results at all. If it produces events, the logic is sound and the fault lies in scheduling, throttling or alert configuration rather than the query itself.

Correlation searches run on the search head, and their alert actions create the notable events surfaced in Incident Review. The search head is therefore the component that generates notables, satisfying the stem's requirement for the generating component within the Splunk Enterprise Security architecture.

Web proxy logs capture HTTP/HTTPS requests and responses, which are the primary protocols used in T1071.001. DNS logs can reveal domain lookups associated with C2 domains. Together, they provide visibility into the web-based communication channels that attackers abuse. Splunk ES can correlate these logs with threat intelligence to detect known malicious domains or anomalous patterns, making them the most relevant data sources for this technique.

The Incident Review dashboard exposes a status field per notable event, letting analysts move events through New, In Progress, Resolved and Closed. Changing that status directly from the dashboard satisfies the stem's requirement for an action available on the event itself.

The notable events framework aggregates and prioritises alerts produced by correlation searches into an analysable queue, giving analysts the triage visibility the Detect function demands. It satisfies the stem by surfacing suspicious activity requiring investigation, complementing the detection logic itself.

Acceleration requires both enabling it on the data model and defining a summary range, which determines how far back summaries are built. Without a summary range, acceleration cannot populate correctly, so this action satisfies the stem's requirement for notable event generation.

Port 445 indicates SMB, a common lateral-movement channel; the Lateral Movement correlation search aggregates authentication and file-share activity across hosts to surface exactly that behaviour, satisfying the requirement to prioritise a search for suspected spread from the infected host.

An Asset in Splunk Enterprise Security is a modelled entity representing a host, server or similar device, populated from asset lookup data and used to enrich notable events. This satisfies the definition by identifying the host or server as the entity being described.

The Asset and Identity framework correlates event fields such as IP, hostname or user against lookup collections, appending asset and identity metadata to notable events during correlation search execution. This satisfies the enrichment requirement by resolving raw identifiers into contextual ownership and priority data.

Scanning external IP ranges for open ports is active reconnaissance: the adversary probes target systems to map exposed services before exploitation. This satisfies the Cyber Kill Chain's reconnaissance phase, which covers both passive and active information gathering against the target.

Microsoft Office applications spawning PowerShell with encoded commands is a common indicator of a malicious macro. Attackers use macros to execute PowerShell, often with base64-encoded payloads to evade detection. This technique is frequently used in phishing campaigns. Splunk ES can detect this by monitoring process creation events where the parent is an Office app and the child is PowerShell with suspicious arguments.

The stats command with dc(src_ip) calculates the distinct count of source IP addresses for each user. This directly provides the number of unique IPs per user. The by user clause groups the results by user, enabling identification of users with more than three distinct IPs. This is the correct and efficient way to achieve the requirement.

The Risk Analysis Dashboard presents risk events chronologically alongside contributing factors, letting the analyst trace which detections accumulated into the score spike. This timeline view directly satisfies the need to see all contributing risk events in sequence rather than as isolated alerts.

The Delivery phase covers weaponisation and transmission, where malicious payloads reach the victim. Email gateway and web proxy logs capture delivery vectors such as phishing attachments and drive-by downloads, directly evidencing this stage rather than exploitation or command-and-control.

Risk Analysis configuration holds the risk framework settings — risk index, risk objects and scoring — that correlation searches write into. It is one of the two ES areas where risk-based alerting is managed, satisfying the stem's requirement for configuring RBA behaviour.

Installing the Splunk App for CIS Benchmarks supplies the prebuilt dashboards, data models and field extractions that map raw CIS-CAT scan output to the Secure Configuration reporting schema. Without it, ingested benchmark results remain unparsed, so the endpoint compliance posture required by the stem cannot be reported.

The Comments section attaches analyst notes directly to the case record, so every team member viewing that case sees the findings in context, unlike personal notes or external documents that remain outside shared investigative workflow.

Notable Event Suppression matches specific field values, such as the scanner's signature or source, and drops only those matching events before they become notables. The correlation search keeps running, satisfying the requirement to suppress without disabling it.

Tags are required to associate events with specific data models and event types within the CIM. For instance, tagging authentication events with 'authentication' and 'success' allows the Authentication data model to include them. Tags are applied via the 'tag' command in props.conf or through the UI. Without correct tags, the data model will not accelerate or include the events, breaking CIM-based correlations.

Risk score adjustments for a specific asset are applied through the risk scoring configuration or by editing lookup tables that map asset attributes to scores. This overrides the default calculation without altering global correlation searches.

In Kerberoasting, an attacker often uses a single compromised account to request service tickets for many SPNs to gather multiple tickets for offline cracking. This behavior results in a high volume of Event ID 4769 requests from one user to various services. Splunk ES can detect this anomaly by analyzing ticket requests per user over time, making it a primary indicator.

The `stats` command calculates aggregations such as count, sum, average and distinct counts across events, directly producing the statistical summaries the question requires. It satisfies the constraint of handling or creating summaries by grouping results with `by` clauses and applying functions like `avg()` or `dc()` to raw search results.

Risk rule weighting is configured within the Correlation Search Editor, where the risk object and its score are defined. Adjusting the weight here changes how much each triggered correlation search contributes to an entity's overall risk score, satisfying the requirement to modify a specific rule's weight.

The Incident Review dashboard in Splunk Enterprise Security provides a risk event drilldown that surfaces the underlying risk events associated with a notable. This allows the analyst to see each contributing risk rule, its risk score, and the risk object involved, which is essential for understanding how the aggregate risk score was built and for prioritizing the investigation appropriately.

This approach directly addresses the false-positive problem by refining the detection logic (filtering out benign activity) and reducing the risk contribution of any remaining matches. Lowering the risk score reduces the impact of the rule on overall risk scores, while the filter reduces the volume of false-positive risk events. This aligns with RBA best practices of tuning risk rules rather than disabling them, and it preserves detection coverage.

The `rename` command changes a field's name in the results table without altering its values, satisfying the readability requirement. Using `as` with a quoted alias, `rename src_ip as "Source Address"` relabels the column header, unlike `eval`, which creates a new field while leaving the original intact.

Urgency sets the severity value assigned to the notable event, which drives its priority ranking and sorting within the Incident Review dashboard. Analysts triage by this ordering, so it satisfies the requirement to determine how prominently the notable appears.

A correlation search only creates a notable when its alert action is configured to trigger the 'Notable' adaptive response action. Without that action enabled, results appear in search but never reach the notable index, so nothing shows in Incident Review despite the search returning matches.

Egress filtering blocks outbound traffic to attacker-controlled infrastructure, severing the channel established during Command and Control. Since C2 depends on beaconing from the compromised host to external servers, restricting outbound destinations directly disrupts this phase, satisfying the strict egress constraint.

A custom alert action is required to integrate with a third-party ticketing system. Splunk ES allows the creation of custom alert actions using the Splunk SDK or REST API, which can be triggered by the correlation search. This enables automatic ticket creation when the notable event is generated, streamlining incident response and ensuring no critical alerts are missed.

Ransomware often spreads laterally via SMB and encrypts shared files, causing a spike in write operations to file servers. This behavior is visible in network traffic or endpoint logs and is a strong indicator of active encryption. Correlating multiple hosts writing to the same server can confirm the attack.

Setting the TZ attribute in props.conf for the affected sourcetype corrects timestamp interpretation at index time, aligning source data with Splunk's expected time zone. This resolves the mismatch preventing correlation searches from generating notable events.

The Endpoint.Filesystem data model tracks file creation, modification, and deletion events from endpoint data sources. It includes fields like file_name, file_path, and action, which are essential for identifying the sudden appearance of files with a specific extension like .locky, a known ransomware indicator. This model is designed for endpoint file activity monitoring.

The Detect function in the NIST CSF is defined as developing and implementing appropriate activities to identify the occurrence of a cybersecurity event. This directly aligns with the analyst's goal of identifying anomalous activity. It includes continuous monitoring, detection processes, and anomaly detection, making it the correct CSF function to prioritize for this objective.

Ransomware is a type of malware that encrypts files on a victim's system and demands payment for the decryption key. The scenario of encrypted files and a ransom note is the classic hallmark of a ransomware attack. Splunk ES can detect ransomware through indicators such as file encryption events, ransom note creation, and unusual process executions.

The Authentication data model in Splunk ES contains login and authentication events, including NTLM authentications. It provides fields like user, src, dest, and authentication type, which are essential for correlating pass-the-hash activity. Querying this data model allows the analyst to trace the compromised accounts and the scope of lateral movement.

The Network Resolution data model in Splunk ES is designed to capture DNS and DHCP activity, including DNS queries and responses. It contains fields such as query, answer, and src, which allow analysts to search for anomalous DNS patterns like high-frequency queries or long subdomains. This data model is the most efficient way to identify DNS tunneling indicators because it normalizes DNS logs from various sources.

The Network_Traffic data model captures network flow data, including source and destination IP addresses, ports, and protocols. It is ideal for identifying internal hosts communicating with external malicious IPs. By searching this model, the analyst can quickly list all affected hosts and the nature of the traffic, enabling rapid containment.

Risk-Based Alerting aggregates many low-fidelity risk events into risk objects and raises notables only when cumulative risk crosses a threshold, so analysts investigate correlated behaviour rather than every individual detection. This aggregation substantially reduces alert noise compared with traditional per-rule alerting.

The transaction command groups events that share a common field (user) and occur within a specified time span (maxspan=10m). It creates a single transaction event containing both the login and privilege escalation, preserving the order and ensuring they are within 10 minutes of each other. This directly satisfies the requirement to correlate related events by user and time proximity.

Lateral Movement consists of techniques that attackers use to enter and control remote systems on a network. Using a compromised user account to move laterally is a classic example of this tactic. The goal is to reach additional systems and potentially escalate privileges or access sensitive data. This directly matches the scenario, making it the correct tactic.

Beaconing produces connections at consistent intervals, so the time deltas between successive requests to the same destination cluster tightly and yield a low standard deviation. Measuring inter-arrival time variance per host-destination pair directly captures periodicity with jitter and is robust to the low volume that defeats volume-based approaches.

RDP hijacking involves taking over an existing RDP session on a remote host, often by using tools that manipulate session IDs. It allows an attacker to move laterally by connecting to a system where a user already has an active session. Splunk ES can detect this through monitoring of RDP logon events, especially those with unusual source or session takeovers.

The OR operator performs a Boolean union, returning events where either the left or right condition evaluates true. This satisfies the stem by matching either condition, unlike AND, which requires both to be true simultaneously.

Data Models in Splunk ES are used to normalize data by defining a common set of fields and applying field aliases and calculations. The Common Information Model (CIM) is implemented through data models, which map vendor-specific fields to standardized field names like 'user'. This allows correlation searches and dashboards to work across different data sources without modification. Data Models are the core component for normalization in Splunk ES, making this the correct answer.

Risk events are stored in the risk index, and searching with index=risk and filtering by user retrieves all risk events for that user. This is the direct method to access risk data for a specific identity, enabling assessment of insider threat activity. It leverages the standard risk index where risk events are indexed.