SIEM Defenses And Data Practices

Which THREE tasks are performed within the 'CIM Setup' interface?

You are a Splunk ES analyst investigating a notable event for an unusual login from a foreign IP. You need to determine the full context of the user's activity around that time, including all related authentication and VPN events. Which feature in Splunk Enterprise Security provides this consolidated view directly from the Incident Review dashboard?

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

A security analyst needs to quickly identify all notable events that are assigned to them and are still open. Which Splunk ES dashboard provides this information with the ability to filter by owner and status?

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

A security analyst is configuring a new correlation search in Splunk Enterprise Security to detect brute-force attacks. The analyst wants to ensure that the notable events generated by this search are properly categorized and can be easily tracked. Which two actions should the analyst perform when creating the correlation search? (Choose two.)

Which THREE components are required for an Adaptive Response action to function?

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

A security team is using Splunk Enterprise Security to monitor for suspicious activity. They want to create a correlation search that triggers a notable event when a user's risk score exceeds a certain threshold. Which Splunk ES feature should they use to automatically adjust risk scores based on events?

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Which TWO actions should be taken if a correlation search is consuming too many system resources?

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

A security engineer is configuring a correlation search that should only trigger a notable event if the source IP is not in a list of known internal IP addresses. The list is maintained in a CSV file on the Splunk search head. Which Splunk ES feature should the engineer use to reference this list within the correlation search?

A security analyst is configuring a new data model in Splunk Enterprise Security to accelerate a correlation search. After creating the data model, the analyst notices that the correlation search is still not performing efficiently. What is the most likely reason for the poor performance?

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Which TWO factors are critical for effective Asset and Identity enrichment?

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

A security team is using Splunk Enterprise Security to monitor for malware infections. They want to ensure that the 'Malware' data model is populated with events from their endpoint protection logs. The endpoint logs are already being ingested and have the correct sourcetype. Which CIM data model should the team map these logs to?

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

A security analyst has created a new correlation search that generates notable events. After the search runs, the analyst notices that the notable events are not appearing in the Incident Review dashboard. The search itself returns results when run manually. Which configuration should the analyst verify first?

When a notable event is generated, where does the 'Risk Score' value originate?

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Which search command is used to join threat intelligence data with your local search results?

A security analyst needs to create a correlation search that detects when a user account is locked out and then successfully logs in within 10 minutes. The analyst wants to ensure that the search does not generate duplicate notable events for the same user within a 24-hour period. Which Splunk Enterprise Security feature should the analyst use to achieve this?

What is the primary function of the 'Notable Event Suppression' feature?

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Which TWO of the following are valid methods for enriching notable events in Splunk ES?

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

A security analyst is new to Splunk Enterprise Security and needs to understand how data is normalized across different sources. They notice that events from different vendors have different field names for the same concept, such as 'user' versus 'username'. Which Splunk ES component is responsible for normalizing these fields to a common schema?

A security analyst is reviewing the Incident Review dashboard in Splunk ES and wants to add a new field to the table that displays notable events. The field, 'src_ip', is already present in the notable event's raw data but not displayed. What should the analyst do to make this field visible in the Incident Review table?

A security analyst notices that a correlation search configured to detect multiple failed logins across the organization is not triggering notable events, even though the raw events are searchable. The correlation search uses the Authentication data model. Upon investigation, the analyst finds that the Authentication data model is not accelerated. What is the most likely reason the correlation search is failing to generate notables?

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Which TWO types of events are typically categorized as 'Notable Events'?

You are building a correlation search that must trigger a notable event when a user's risk score exceeds 100 within a 24-hour period. The risk score is calculated from multiple risk events across different indexes. Which Splunk ES component should you use to aggregate the risk events and evaluate the threshold?

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?