38 questions · Investigation And Risk Management · All types, answers revealed
Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?
Documenting findings is critical for auditability and collaboration.
Why this answer
Triage and documentation are essential parts of the Incident Review and Case Management process.
When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?
This is the primary function of the 'Notable' adaptive response action.
Why this answer
The 'Notable' action type specifically triggers the creation of a notable event in the Incident Review dashboard.
Which THREE pieces of information are commonly found in a Splunk ES Case?
Metadata keeps track of case state and assignment.
Why this answer
Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.
Which TWO factors influence an object's final risk score in Splunk ES?
These are the base values that get added together.
Why this answer
The final score is influenced by the individual event scores and the aggregation method applied.
An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?
The 'Add to Case' action is directly available in the Incident Review interface.
Why this answer
From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.
Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?
This provides granular risk scoring data.
Why this answer
Risk Analysis, Incident Review, and Security Posture are the primary dashboards for investigation.
Which THREE actions are part of the 'Incident Review' investigation workflow?
Updating status shows progress in the lifecycle.
Why this answer
Investigating involves triaging, assigning, and changing statuses.
When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?
This field maps the notable event to the originating correlation search.
Why this answer
The 'Search Name' field in the Incident Review dashboard clearly identifies the correlation search that triggered the notable.
What is the purpose of the 'Investigation Workbench' in Splunk ES?
It helps consolidate investigation data for analysts.
Why this answer
The Investigation Workbench provides a centralized view of all entities, events, and context related to a specific incident.
When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?
This dashboard displays the breakdown of risk scores by object and contributing events.
Why this answer
The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.
In the Incident Review dashboard, what does 'Status' represent?
Status indicates where the incident is in the response process.
Why this answer
Status tracks the progress of an investigation, such as 'New', 'In Progress', or 'Closed'.
A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?
Notable Event Suppression allows analysts to define criteria to ignore specific events that should not trigger a notable.
Why this answer
Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.
Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?
Severity is a core column used for prioritization.
Why this answer
The dashboard displays core event information, including status and severity.
Which THREE features are provided by the Splunk ES Incident Review dashboard?
Analysts update the status of the investigation here.
Why this answer
The Incident Review dashboard is the hub for notable event triage, status tracking, and assignment.
If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?
The Index Manager is the correct place to adjust retention settings for any index, including the risk index.
Why this answer
Index retention policies are managed in the Splunk index settings (indexes.conf) or via the Manager interface.
Which TWO methods can be used to suppress unwanted notable events?
This allows the search itself to exclude certain patterns.
Why this answer
Notable event suppression and correlation search suppression are the standard ways to manage alert noise.
Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?
Case Management is specifically designed for incident lifecycle tracking.
Why this answer
Case Management provides the structure and tools for incident lifecycle management.
Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?
The Risk data model is the primary model used to store and query risk-related events in Splunk ES.
Why this answer
While it can run on raw events, the Risk Analysis action is often used in correlation searches that monitor data models like 'Network Traffic' or 'Authentication'.
Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?
You provide a descriptive message for the risk event.
Why this answer
The action allows configuration of the risk object, score, and message.
Which THREE elements are essential for a well-defined risk-based alert?
The threshold determines when risk becomes a notable.
Why this answer
RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.
A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?
The most common reason for 0 results is a mismatch between the search logic and the indexed data fields.
Why this answer
If the search returns no results, the logic inside the search is likely too restrictive, such as incorrect data model mapping or field names.
During an investigation, you need to group related notables into a single investigation container. Which feature should you use?
Case Management allows analysts to create cases and add relevant notable events to them.
Why this answer
In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.
When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?
The 'sum' aggregation logic aggregates individual event scores into a total score.
Why this answer
The 'sum' aggregation method cumulatively adds the risk score of every incident to the total score of the object.
What is the benefit of using the Asset and Identity framework in Splunk ES investigations?
Contextual enrichment makes events more actionable.
Why this answer
It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.
You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?
ES settings contain the global configuration for risk scoring and decay.
Why this answer
The 'Risk Analysis' settings in the ES app configuration dictate how long risk scores persist before decaying.
You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?
splunkd.log contains logs for adaptive response executions and scheduling errors.
Why this answer
The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.
Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?
Updating the status is a key part of incident lifecycle management.
Why this answer
Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.
If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?
tstats is the recommended approach for searching indexed data models.
Why this answer
The 'tstats' command is the most efficient way to query the risk data model for events associated with a specific field value.
In the context of Splunk ES, what is an 'Asset'?
Assets are entities identified within the environment for risk context.
Why this answer
An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.
An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?
This dashboard provides a dedicated view for analyzing risk event timelines for specific entities.
Why this answer
The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.
Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?
This is where global risk scoring and decay settings are defined.
Why this answer
The Correlation Search Editor and the Risk Analysis settings are the core locations for managing RBA.
When investigating a case, where should an analyst document their findings to ensure they are available to other team members?
The Comments section is designed for team collaboration and case logging.
Why this answer
Case Management supports adding comments or notes to a case to facilitate collaboration.
A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?
The risk score for a specific rule is typically defined within the 'Risk Analysis' adaptive response action settings in the correlation search.
Why this answer
Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.
You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?
The Risk Analysis action tags the event with risk metadata and writes it to the risk index.
Why this answer
The Risk Analysis adaptive response action is the core mechanism in Splunk ES used to generate risk events from notable events or correlation searches.
Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?
RBA aggregates multiple signals to identify higher-confidence threats.
Why this answer
RBA reduces alert fatigue by focusing on aggregated activity rather than single, potentially noisy events.
When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?
The risk_score parameter defines the weight assigned to the specific event triggering the action.
Why this answer
The 'risk_score' is the value assigned to an event to quantify the level of risk associated with that activity.
What is the primary function of the 'Risk Notable' correlation search in Splunk ES?
This is the core purpose of the Risk Notable correlation search.
Why this answer
The 'Risk Notable' search monitors the 'risk' index and triggers a notable event when an object's aggregated risk score exceeds a defined threshold.
Which TWO types of data are commonly enriched by the Asset and Identity framework?
Asset context, such as ownership, is added to events.
Why this answer
The framework is primarily used to add context to users and hosts (assets).
Ready to test yourself?
Try a timed practice session using only Investigation And Risk Management questions.