Investigation And Risk Management

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Which THREE pieces of information are commonly found in a Splunk ES Case?

Which TWO factors influence an object's final risk score in Splunk ES?

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?

Which THREE actions are part of the 'Incident Review' investigation workflow?

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

What is the purpose of the 'Investigation Workbench' in Splunk ES?

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

In the Incident Review dashboard, what does 'Status' represent?

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Which THREE features are provided by the Splunk ES Incident Review dashboard?

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Which TWO methods can be used to suppress unwanted notable events?

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Which THREE elements are essential for a well-defined risk-based alert?

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

In the context of Splunk ES, what is an 'Asset'?

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Which TWO types of data are commonly enriched by the Asset and Identity framework?