CCNA Investigation And Risk Management Questions

Case documentation and updates provide the auditable record of an investigation, capturing evidence, findings and actions as they evolve. This satisfies the workflow requirement for traceable incident handling, ensuring analysts can hand over, review and report on progress within Splunk ES.

The Identity Investigator is a Splunk ES tool that displays identity details such as role, department, and watchlist status from the identity lookup. This helps the analyst understand the user's importance and whether they are on a watchlist, which informs the potential impact. It is the appropriate tool for identity enrichment.

The Risk Event link in a notable's detail view is designed exactly for this pivot. It launches a search against the risk index filtered to the risk object(s) tied to the notable, letting the analyst see every contributing risk event. This is the intended workflow for moving from an aggregated notable to its underlying risk events without manually constructing a search.

The Notable action type writes an entry into the Incident Review dashboard, generating a notable event with its severity, owner and status fields so analysts can triage it. It does not itself perform containment or enrichment on the originating host.

The Risk Analysis dashboard in Splunk Enterprise Security aggregates risk events and displays risk scores by risk object, such as users and systems. It provides a ranked view of the highest-risk entities, exactly what the manager needs to assess overall risk posture.

Splunk ES cases record investigation metadata such as status and owner, letting analysts track who is handling the case and its current stage. This administrative context is a standard component of case data, satisfying the question's requirement for commonly found information.

Each contributing risk event carries its own score, and the object's final value derives from those individual contributions. This satisfies the question directly: without the underlying event scores there is nothing for the aggregation logic to combine into a final risk score.

Within Incident Review, selecting the event and choosing 'Add to Case' attaches that event to an existing case, preserving its evidence linkage. This is the manual procedure for enriching an open investigation without creating a new case.

The threat intelligence data model in Splunk Enterprise Security stores indicators and their associated context, and pivoting on an indicator lets the analyst review every event linked to it across the index retention period. This directly answers whether the indicator has been seen, using existing indexed data without waiting for new detections or building additional correlation logic.

Changing a notable's status is a core Incident Review action, moving events through triage states such as New, In Progress and Closed. This satisfies the workflow requirement by recording analyst decisions and tracking resolution progress directly on the notable event.

The severity displayed on a finding in Incident Review is taken from the severity field configured in the correlation search's alert action settings. Even if the underlying risk score is moderate, the correlation search can explicitly assign a severity value such as 'high', which overrides any score-derived severity and is what the analyst sees on the notable.

Each notable event carries a Search Name field populated by the correlation search that produced it, letting analysts trace provenance directly. Checking this field confirms which specific correlation search fired, satisfying the stem's verification requirement without inspecting saved search configurations manually.

The Investigation Workbench consolidates artefacts — notable events, contributing events, assets, identities and threat intelligence — into a single pane, satisfying the stem's requirement for a unified incident view. Analysts pivot across these linked artefacts without switching searches, which is precisely the centralised triage capability Splunk ES intends this interface to deliver.

The Risk Analysis Dashboard visualises risk contributors per user, satisfying the stem's requirement for a user-specific view of contributing risk factors. It aggregates risk events by risk object, showing which detections and sources drive a user's score, unlike the Incident Review or Risk Notables views.

'Status' tracks each notable event through the investigation workflow stages configured in Enterprise Security, such as New, In Progress, and Resolved. This satisfies the stem's requirement by representing workflow progression rather than severity, urgency, or owner assignment, letting analysts filter the Incident Review dashboard by investigation stage.

Throttling or exception logic prevents a risk rule from repeatedly contributing risk for the same entity in a short period. This directly addresses the repeated firing on benign activity for this user while keeping the rule active for other entities. It is the targeted approach that reduces score inflation without disabling detection.

Correlation Search Suppression lets you define a suppression rule directly on the Risk Notable correlation search, filtering out low-fidelity risk events before they generate notables. Editing the search itself or downstream risk rules would not cleanly exclude those events at source.

Severity is one of the two metrics displayed in the Notable Event list, satisfying the dashboard's requirement to surface prioritisation data for triage. Each notable event row shows its severity alongside the event name, letting analysts rank incidents by urgency directly within the Incident Review dashboard.

Status management lets analysts assign, track and update notable event states such as New, In Progress and Closed directly within Incident Review, satisfying the stem's requirement for features the dashboard provides rather than external workflow tooling.

Retention for indexes is configured through the Index Manager interface, which exposes per-index settings including the default retention period. Editing the 'risk' index there changes its retention directly, satisfying the requirement to modify the default.

Risk scores are derived from risk events currently retained in the risk index. If some contributing events have aged out due to retention limits, they no longer contribute to the score. This is the most likely reason the total is lower than expected when summing all rule weights the analyst believes should apply. The scoring window and index retention directly bound which events count.

Correlation search suppression configures a search to stop generating notable events for defined conditions, such as a maintenance window or known benign pattern. It prevents unwanted notables at generation time, satisfying the stem's requirement for a suppression method.

Case Management tracks an incident through its full lifecycle, holding status, owner, priority and assignment details, and linking the contributing notables together so analysts can update and hand off investigations rather than working from the Incident Review dashboard alone.

The Risk Analysis adaptive response action writes and reads risk scores through the Risk Data Model, which stores risk objects, scores and annotations. Enrichment of events with calculated risk context therefore depends on that model's fields, satisfying the stem's requirement for the data model the action relies upon.

Risk Message is a configurable field within the Risk Analysis adaptive response action, letting analysts attach a descriptive annotation to the risk event. This satisfies the stem by naming one of the three settings the action exposes.

Risk-based detections must produce risk events that specify which entity the risk applies to and the score contribution. Without a risk object and a risk score value, the event cannot be attributed to an entity or affect its risk profile. This is the core mechanism by which a detection feeds the risk framework rather than only generating a standalone notable.

The Event Details panel in Incident Review shows the notable event's fields, including the correlation search name, risk objects, risk scores, and other metadata. It is the primary place to see why a notable was generated and which entities contributed risk. This directly answers the analyst's need to identify the generating search and risk objects without running additional searches.

Adjusting the risk score value for a risk rule directly controls the contribution of each risk event to an object's total risk score. Lowering this value reduces the rule's influence without disabling it, which is ideal for mitigating alert fatigue while retaining visibility into the activity. This is the intended method for tuning risk rules in Splunk Enterprise Security.

The search executes successfully but matches nothing, so the correlation search's filtering logic, such as field names, thresholds or time windows, does not correspond to the indexed data. Correcting the search logic to match actual field values should produce risk events.

The risk score assigned to a risk rule determines how much risk is added to the associated risk objects. A score that reflects severity and confidence ensures that high-fidelity detections contribute more risk, while low-confidence ones contribute less. This is a key part of RBA configuration because it directly influences when risk thresholds are crossed and notables are generated. It also helps prioritize investigations based on aggregated risk.

Splunk Case Management groups related notables, events and artefacts into a single investigation container, preserving shared context, ownership and status. This directly satisfies the need to consolidate related notables, which standalone correlation searches or dashboards cannot do.

The risk_object_type field specifies the category of the risk object, such as user, system, or other. It is required so the framework knows how to interpret and store the risk event. Without it, the risk event may be discarded or misattributed, preventing accurate risk scoring.

With sum aggregation, each qualifying risk event contributes its own score, and the total for an object within the window is the arithmetic total of those individual event scores. This additive behaviour is precisely what the 'sum' method specifies, so overlapping events accumulate rather than being averaged or deduplicated.

The Asset and Identity framework enriches raw events with lookup-derived attributes such as owner, priority, and business unit. This enrichment supplies the contextual detail analysts need during investigations, satisfying the stem's requirement to provide context to events rather than merely correlating or filtering them.

Incident Review is the primary interface in Splunk Enterprise Security for investigating notables, providing access to the raw event, risk events, threat intelligence, and other contextual data via the Event Timeline and drill-down actions. It allows analysts to pivot seamlessly between the notable and related evidence, enabling efficient triage and investigation.

Risk score lifespan is governed by the decay settings within the Risk Analysis configuration in Enterprise Security settings, where the decay period and decay type define how scores age over time. Adjusting these values restores decay for the affected asset, satisfying the requirement that stale risk scores diminish rather than persist indefinitely.

The Incident Review dashboard exposes a status field per notable event, letting analysts move events through New, In Progress, Resolved and Closed. Changing that status directly from the dashboard satisfies the stem's requirement for an action available on the event itself.

An Asset in Splunk Enterprise Security is a modelled entity representing a host, server or similar device, populated from asset lookup data and used to enrich notable events. This satisfies the definition by identifying the host or server as the entity being described.

The Risk Analysis Dashboard presents risk events chronologically alongside contributing factors, letting the analyst trace which detections accumulated into the score spike. This timeline view directly satisfies the need to see all contributing risk events in sequence rather than as isolated alerts.

Risk Analysis configuration holds the risk framework settings — risk index, risk objects and scoring — that correlation searches write into. It is one of the two ES areas where risk-based alerting is managed, satisfying the stem's requirement for configuring RBA behaviour.

The Comments section attaches analyst notes directly to the case record, so every team member viewing that case sees the findings in context, unlike personal notes or external documents that remain outside shared investigative workflow.

Risk rule weighting is configured within the Correlation Search Editor, where the risk object and its score are defined. Adjusting the weight here changes how much each triggered correlation search contributes to an entity's overall risk score, satisfying the requirement to modify a specific rule's weight.

The Incident Review dashboard in Splunk Enterprise Security provides a risk event drilldown that surfaces the underlying risk events associated with a notable. This allows the analyst to see each contributing risk rule, its risk score, and the risk object involved, which is essential for understanding how the aggregate risk score was built and for prioritizing the investigation appropriately.

This approach directly addresses the false-positive problem by refining the detection logic (filtering out benign activity) and reducing the risk contribution of any remaining matches. Lowering the risk score reduces the impact of the rule on overall risk scores, while the filter reduces the volume of false-positive risk events. This aligns with RBA best practices of tuning risk rules rather than disabling them, and it preserves detection coverage.

Risk-Based Alerting aggregates many low-fidelity risk events into risk objects and raises notables only when cumulative risk crosses a threshold, so analysts investigate correlated behaviour rather than every individual detection. This aggregation substantially reduces alert noise compared with traditional per-rule alerting.

Risk events are stored in the risk index, and searching with index=risk and filtering by user retrieves all risk events for that user. This is the direct method to access risk data for a specific identity, enabling assessment of insider threat activity. It leverages the standard risk index where risk events are indexed.

The Authentication data model normalizes authentication activity from various sources into a common schema, including user, source, action, and outcome fields. This normalization enables the analyst to correlate failures and subsequent successes from the same source efficiently, even when logs originate from different systems across multiple indexers. It is the intended tool for this type of authentication-centric investigation.

Triage and prioritization are fundamental to the investigation workflow, as they help analysts focus on the most critical notables first. Risk scores and urgency provide context for ordering investigations, ensuring that high-impact threats are addressed promptly. This phase is essential for efficient SOC operations.

The risk_score parameter supplies the numeric increment applied to an object's existing risk score, not a replacement value. Splunk ES sums these contributions from risk rules and adaptive responses, so the constraint that the object's cumulative risk reflects added weight is satisfied by this additive behaviour.

This correlation search aggregates per-object risk scores and fires a notable when the accumulated total crosses the configured risk threshold, satisfying the requirement to surface objects whose risk has escalated. It does not itself assign risk; it evaluates the summed score against the threshold.

Using a formula that multiplies the count by a weight lets the risk score scale with the number of failures. By applying this as the risk score in a single correlation search per user per window, the analyst avoids emitting a risk event for every failure while still capturing proportionality. This directly satisfies both the scaling and event-reduction requirements.

The framework enriches events with host and asset context, including hostname, IP address, operating system and asset priority pulled from asset lookup tables. This satisfies the requirement by attaching device metadata to raw events, so detections and risk scoring can evaluate the originating host.

Cases in Splunk Enterprise Security are investigative containers that can hold multiple notables, events, and artifacts. Analysts add relevant notables to a case to group related findings. This reflects the intended workflow: triage notables, then consolidate related ones into a case for coordinated investigation, evidence gathering, and documentation.

Asset Investigator provides a consolidated timeline of events and risk-related activity for a specific asset, such as a host or IP address. It aggregates data from multiple sources to give the analyst a unified view of what happened on that entity. This is the appropriate tool for examining all recent activity related to the workstation in question.

Incident Review allows analysts to add comments, change status, and assign ownership directly on notable events. These updates are stored with the notable and provide an audit trail of the disposition and supporting notes. This is the built-in mechanism for documenting review outcomes and evidence within Splunk ES.

The risk_object_type field identifies the kind of entity the risk applies to, such as user, system, or other. By explicitly setting it to 'user', the risk event is attributed only to user entities, preventing the same rule from inflating risk scores for systems or IPs. This is the correct way to scope a risk rule to a specific entity type.