Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) (SPLK-5001) — Questions 226–283

Splunk ES provides a configuration page for Incident Review table attributes where administrators can specify which fields appear as columns. By adding 'src_ip' to the list of attributes, it will be displayed in the table. This is the correct and supported method to customize the Incident Review dashboard's columns without modifying underlying searches or dashboards.

The stats command is the primary aggregation command in SPL. It supports functions like count, sum, avg, min, max, and dc, and the by clause groups results by specified fields. This allows analysts to summarize large volumes of events into meaningful metrics for detection and reporting.

This is correct because base search terms using field=value and field>value are evaluated as Boolean AND conditions, so only events where action equals blocked and bytes_out exceeds 5000 are returned. Events missing the action field are automatically excluded because the term action=blocked cannot match them, satisfying the requirement to filter out incomplete events.

Acceleration pre-computes data model summaries, enabling faster searches. Without acceleration, the correlation search may exceed time limits or fail to process large datasets, leading to no notables. In Splunk ES, many correlation searches depend on accelerated data models for performance and reliability. Thus, enabling acceleration on the Authentication data model is critical for this search to function.

Owner filtering restricts the notable event list to those assigned to a specific analyst, supporting workload management and handover. It satisfies the stem's requirement because owner is a standard, editable field on notable events and appears as a built-in filter in the Incident Review dashboard.

Sysmon Event ID 1 records process creation, including the full command line, parent process and hashes. This satisfies the LotL hunt because built-in utilities such as PowerShell or certutil appear as ordinary processes, and only their command-line arguments expose malicious use.

The transaction command groups related events sharing common field values into single transactions, revealing multi-event patterns such as sequences of actions. This satisfies the pattern-identification criterion because it exposes relationships across events that individual searches would miss.

Exfiltration is the ATT&CK tactic that describes techniques adversaries use to steal data from your network, such as over command and control channels or via physical media. In Splunk ES, detections for large outbound transfers or unusual DNS queries map to this tactic. Focusing on Exfiltration helps analysts identify and block data loss at the point of egress.

Event Code 4624 with Logon Type 3 (network logon) and NTLM authentication indicates a logon using NTLM, which is common in pass-the-hash attacks. Attackers use stolen NTLM hashes to authenticate laterally. Reviewing these events for anomalous source IPs or accounts can reveal pass-the-hash activity. It is a key indicator to investigate.

The Threat Intelligence data model in Splunk ES stores indicators of compromise (IOCs) from various threat feeds. Searching for the file hash in this data model will reveal if it is known malicious. This is the standard method to leverage integrated threat intelligence for file reputation within Splunk ES.

RBA assigns risk scores to entities from detections rather than alerting on each individually, so analysts triage behaviour across users, hosts and IPs. This surfaces correlated behavioural indicators that single-event correlation searches miss, satisfying the stem's benefit of focusing on behaviour rather than isolated events.

The Authentication data model captures authentication events, including the authentication method and source/destination hosts. Pass-the-hash attacks often involve NTLM authentication from a source workstation to a different destination workstation. Filtering on authentication_method=NTLM and src!=dest helps identify such lateral movement, which is a key indicator of pass-the-hash.

Clearing the Windows Security Event log generates event ID 1102, which records audit log deletion. The Change Analysis data model tracks changes to system and audit configurations, making it the model that surfaces this action.

`mvcombine` merges values from multiple events into a single multi-value field, satisfying the requirement to manipulate multi-value fields. It groups values sharing a common field, combining them into one delimited list per group. This directly transforms event-level values into a consolidated multi-value field, which is the manipulation the question demands.

The `earliest=` and `latest=` search command arguments restrict results to a specified time window, satisfying the requirement to filter events by time. They accept absolute timestamps or relative modifiers such as `-24h`, applying the constraint at search time rather than relying on indexed fields.

Lateral movement detection relies on authentication events, since attackers pivoting between hosts generate logon activity across systems. The Authentication Data Model normalises these events, so populating and enabling it gives the correlation searches the data required to surface lateral movement in Splunk ES.

Asset Investigator aggregates every discovered asset and groups them by business criticality, directly satisfying the stem's requirement for an organisation-wide summary categorised by criticality. Unlike posture or vulnerability dashboards, it centres on asset inventory classification rather than risk scoring, making it the appropriate view for this specific reporting need.

The Authentication data model normalizes authentication activity from various sources into a common schema, including user, source, action, and outcome fields. This normalization enables the analyst to correlate failures and subsequent successes from the same source efficiently, even when logs originate from different systems across multiple indexers. It is the intended tool for this type of authentication-centric investigation.

This search filters all events with any EventCode, then uses stats to count events per EventCode, filters with where count > 100, and sorts descending by count. It correctly applies the threshold after aggregation and sorts the results as required.

The `streamstats` command can compute the time difference between successive events, such as connections from an internal host to an external IP. By analyzing the delta times, you can identify regular intervals indicative of beaconing. This is a core technique in Splunk for detecting periodic behavior without relying solely on pre-built correlation searches, and it works well with raw network traffic logs.

The Assets and Identity Data Model normalises asset inventory fields such as hostnames, IP addresses and ownership, which the CIS Control 1 requirement for tracking enterprise assets depends on. It is the only model providing that asset-centric visibility for Splunk searches.

Sysmon EventCode 1 records process creation and includes the Image field with the full executable path. Filtering where Image contains the Public directory surfaces executions from that untrusted location, which is a common staging area for attackers and a valid hunt hypothesis.

Firewall logs record network connections, including source and destination IP addresses, ports, and protocols. Command and control (C2) communications often involve outbound connections to malicious servers. By analyzing firewall logs for unusual destinations or beaconing patterns, analysts can detect C2 activity. Therefore, firewall logs are a primary data source for identifying C2 communications in the Cyber Kill Chain.

Tools like ProcDump or Task Manager can create a memory dump of lsass.exe, often saved as lsass.dmp. The Endpoint.Filesystem data model can detect the creation of such files. This is a direct artifact of credential dumping, as the dump file contains credential material. Its presence in a temp directory is highly suspicious.

xyseries pivots the count field so that host values become rows and sourcetype values become columns, satisfying the requirement to display field values as columns. The preceding stats count by host, sourcetype supplies the aggregated values that xyseries then reshapes into a tabular, column-oriented layout.

Threat Source management is a core component, letting analysts configure, enable and prioritise the external intelligence feeds that populate the framework. It satisfies the stem's requirement for key components by governing which sources supply indicators, alongside intelligence downloads and lookups, ensuring only vetted feeds drive correlation searches and notable event enrichment.

The timechart command with span=1h automatically buckets events into hourly intervals and counts them, producing a time-series chart. Filtering by user=john.doe focuses on the specific user, and the result is a chart of event counts per hour.

The Respond function includes activities to take action regarding a detected cybersecurity event. Splunk ES's incident review and collaboration tools allow analysts to triage, investigate, and coordinate response efforts. Features like the incident review dashboard, commenting, and assignment of investigations directly support the Respond function by enabling efficient incident handling and communication among team members.

This search aggregates events per user with stats, then uses eventstats to append the sum of all user counts as a running total field across every row, and eval calculates each user's percentage of that total. Sorting descending by pct places the largest share first, which is exactly the requested output.

The Splunk App for CIS Benchmarks provides prebuilt dashboards, data models and correlation searches that ingest CIS-CAT assessment output and report pass/fail per control, directly satisfying the requirement to ingest and report Linux CIS compliance checks without custom field extraction or search development.

Timechart aggregates events into time-based buckets, directly exposing the periodic interval of connections to the specified domain. This satisfies the stem's requirement to identify beaconing frequency, since regular spikes at consistent intervals reveal the C2 rhythm that a raw event listing would obscure.

append runs a subsearch and adds its results to the current result set, which is exactly the concatenation the stem describes. It differs from join, which correlates fields, and union, which merges datasets rather than appending.

Triage and prioritization are fundamental to the investigation workflow, as they help analysts focus on the most critical notables first. Risk scores and urgency provide context for ordering investigations, ensuring that high-impact threats are addressed promptly. This phase is essential for efficient SOC operations.

The risk_score parameter supplies the numeric increment applied to an object's existing risk score, not a replacement value. Splunk ES sums these contributions from risk rules and adaptive responses, so the constraint that the object's cumulative risk reflects added weight is satisfied by this additive behaviour.

This correlation search aggregates per-object risk scores and fires a notable when the accumulated total crosses the configured risk threshold, satisfying the requirement to surface objects whose risk has escalated. It does not itself assign risk; it evaluates the summed score against the threshold.

`mvexpand` takes each value within a multi-value field and creates a separate event for it, directly satisfying the requirement to split values into individual events. Unlike `mvcombine`, which merges values, or `nomv`, which flattens a field into a single string, `mvexpand` preserves each value as its own event.

The Incident Review dashboard is the primary triage workspace in Splunk Enterprise Security, letting analysts assign, prioritise and track notable events through their lifecycle. It satisfies the stem's focus on purpose by centralising notable event management, rather than providing correlation search configuration or data model acceleration.

Using a formula that multiplies the count by a weight lets the risk score scale with the number of failures. By applying this as the risk score in a single correlation search per user per window, the analyst avoids emitting a risk event for every failure while still capturing proportionality. This directly satisfies both the scaling and event-reduction requirements.

Analysts can manually create incidents in Incident Review, and these are stored and treated as notable events alongside correlation search output. This satisfies the requirement by covering the human-generated category, distinguishing it from automated detections and ordinary indexed events.

`dedup event_id` removes duplicate events by comparing values in the specified field, retaining only the first occurrence of each unique event_id. This directly satisfies the requirement to eliminate duplicates based on a field, unlike commands that merely group or count events without discarding the redundant copies.

This works because DNS tunneling relies on unusually long, high-entropy query names and many unique subdomains to a single parent. Aggregating query name length and unique subdomain counts in the Network_Traffic data model surfaces that pattern, and a correlation search can alert on thresholds, which is exactly how Splunk ES commonly detects this behavior.

The Asset and Identity framework ingests lookup tables to maintain an authoritative, current inventory of authorised software and associated assets. Within the Identify function, this supports asset management and governance by keeping the software list accurate and queryable.

Email logs capture embedded links, so extracting and inspecting URLs reveals mismatched or spoofed destinations that legitimate senders would not use. A suspicious URL in the email body is therefore a primary phishing indicator detectable directly from the URL field within mail telemetry.

The framework enriches events with host and asset context, including hostname, IP address, operating system and asset priority pulled from asset lookup tables. This satisfies the requirement by attaching device metadata to raw events, so detections and risk scoring can evaluate the originating host.

Scheduled Searches run saved hunt queries automatically at defined intervals, removing manual re-execution. This directly satisfies the stem's recurring automation requirement by dispatching detections continuously, with results available for review or downstream alerting without analyst intervention.

Event ID 4724 records a password reset attempt and identifies the account performing the reset. Correlating the reset actor with the target account's later logon locations reveals whether the target then authenticates from unfamiliar addresses, a strong indicator of attacker-driven resets for access retention. Comparing against the target's historical source IP baseline separates routine helpdesk activity from abuse.

Cases in Splunk Enterprise Security are investigative containers that can hold multiple notables, events, and artifacts. Analysts add relevant notables to a case to group related findings. This reflects the intended workflow: triage notables, then consolidate related ones into a case for coordinated investigation, evidence gathering, and documentation.

This approach uses the accelerated data model for efficient aggregation, computes outbound volume per host, and compares recent activity against a historical baseline. Flagging deviations above normal behavior isolates hosts whose transfer volume is anomalous for them, which is precisely the signal of potential exfiltration.

This detection focuses on the actual running of malicious code via PowerShell, which falls under the Execution tactic. MITRE ATT&CK defines Execution as techniques that result in adversary-controlled code running on a local or remote system. Encoded PowerShell commands are a classic example of T1059.001, and Splunk ES maps such detections to Execution to help analysts understand the adversary's operational phase.

The Risk Analysis framework in Splunk ES collects risk events from various sources into the 'risk' index. A correlation search can then search the 'risk' index, aggregate risk scores by user, and trigger a notable when the threshold is exceeded. This is the intended use of the framework, which provides a centralized way to manage risk-based alerting. The correlation search should use the 'risk' index and sum the risk_score field.

The Risk Analysis adaptive response action writes a risk event to the risk index, recording a risk score against a named risk object such as a user, host or system. This attribution lets subsequent risk notables aggregate and prioritise by entity.

The Threat Sources page lists every configured intelligence feed with its status, letting you verify which sources are enabled and actively contributing indicators. It is the definitive location for confirming ingestion health, satisfying the requirement to check that threat sources are active.

Change Analysis tracks modifications to system configuration and policy objects, including audit policy changes made via auditpol.exe. Its Change data model captures the object affected, the action taken and the user responsible, satisfying the stem's requirement to locate audit-policy modification events within Splunk's Common Information Model.

Asset Investigator provides a consolidated timeline of events and risk-related activity for a specific asset, such as a host or IP address. It aggregates data from multiple sources to give the analyst a unified view of what happened on that entity. This is the appropriate tool for examining all recent activity related to the workstation in question.

Exploitation is the phase where an attacker leverages a discovered weakness by running code or a crafted payload against it, turning a vulnerability into actual access or execution. It follows weaponisation and delivery, and precedes installation, so its defining goal is triggering the flaw to gain a foothold.

Incident Review allows analysts to add comments, change status, and assign ownership directly on notable events. These updates are stored with the notable and provide an audit trail of the disposition and supporting notes. This is the built-in mechanism for documenting review outcomes and evidence within Splunk ES.

The risk_object_type field identifies the kind of entity the risk applies to, such as user, system, or other. By explicitly setting it to 'user', the risk event is attributed only to user entities, preventing the same rule from inflating risk scores for systems or IPs. This is the correct way to scope a risk rule to a specific entity type.

Incident Review in Splunk ES provides a centralized view of notables and allows analysts to drill down into associated events. It enables pivoting to raw events, asset information, and threat intelligence. This is the correct feature for investigating an alert and gathering context from multiple data sources.