49 questions · SIEM Defenses And Data Practices · All types, answers revealed
Which THREE tasks are performed within the 'CIM Setup' interface?
Mapping is the primary function of CIM Setup.
Why this answer
CIM Setup allows administrators to map sourcetypes to data models, enable acceleration, and verify CIM compliance.
You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?
Access control is fundamentally managed via index-level role permissions.
Why this answer
Data model-based security and index-level access controls are used to restrict visibility to events based on user roles.
A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?
Acceleration creates summary indexes for data models, which are optimized for correlated searches.
Why this answer
Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.
A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?
Summaries drastically reduce the data scanned by the search engine.
Why this answer
Adjusting the time range picker or optimizing the search by using specific indexes or summaries will reduce scan volume.
Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?
Incident Review is the primary console for managing event status.
Why this answer
The Incident Review dashboard provides the interface for managing statuses, owners, and comments for notable events.
Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?
The Security Posture dashboard shows framework-based threats.
Why this answer
The Security Posture dashboard and the MITRE ATT&CK mapping dashboard are standard features for viewing framework coverage.
Which THREE components are required for an Adaptive Response action to function?
If disabled, the action will not trigger.
Why this answer
Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.
You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?
Scripts for custom actions reside in the application's bin folder.
Why this answer
The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.
You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?
Mapping the owner field to an extraction ensures dynamic assignment.
Why this answer
The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.
What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?
Retention policies define the lifespan of the event data.
Why this answer
This controls how long the KV Store and index data associated with ES remain available before being purged or aged out.
What is the purpose of the 'Assets and Identities' framework in Splunk ES?
Enrichment provides necessary context for investigation.
Why this answer
This framework enriches events with contextual information such as business unit, ownership, and priority.
Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?
CIM tagging is mandatory for data model mapping.
Why this answer
Normalization via CIM tags, correct sourcetype identification, and ensuring the data model is accelerated are standard prerequisites for ES data models.
Which TWO actions should be taken if a correlation search is consuming too many system resources?
Running the search less often reduces cumulative load.
Why this answer
Optimizing the search query and reducing the search frequency (cron) are the primary ways to reduce resource impact.
When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?
Risk analysis helps in detecting patterns across different alert types.
Why this answer
Assigning a risk object (like a user or system) allows for the aggregation of multiple low-fidelity alerts into a single actionable risk score.
Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?
Tags are the primary mechanism for CIM mapping.
Why this answer
The 'tag=network' and 'tag=communicate' (or similar) tags are required to map events to the Network Traffic data model.
Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?
Context turns raw logs into actionable intelligence.
Why this answer
Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).
Which TWO factors are critical for effective Asset and Identity enrichment?
Inaccurate sources lead to poor enrichment.
Why this answer
The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.
You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?
The $var$ syntax is standard for passing tokens in Splunk.
Why this answer
Using the dollar sign syntax ($field_name$) allows for dynamic substitution of event fields into the drilldown URL.
Which TWO factors directly impact the urgency of a notable event in Splunk ES?
The risk score is a direct input for urgency.
Why this answer
Urgency is calculated by combining the event's inherent risk score and the criticality of the system or user (asset) involved.
When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?
The CIM Validator is the standard tool for verifying mapping compliance.
Why this answer
Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.
Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?
Checking the output of the notable index confirms event creation.
Why this answer
Scheduler logs, search job inspector, and the internal notable event index are all key to diagnosing search failures.
Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?
This dashboard manages feed health and configuration.
Why this answer
The Threat Intelligence Manager is the interface for managing and monitoring external threat feeds.
You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?
Adaptive Response relies on correctly configured Add-ons and connectivity.
Why this answer
The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.
When a notable event is generated, where does the 'Risk Score' value originate?
Risk factors are user-defined during search configuration.
Why this answer
The risk score is calculated based on the risk factor assigned to the alert in the correlation search configuration.
You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?
The manager handles individual feed update schedules.
Why this answer
The Threat Intelligence Manager allows you to define the update interval for individual threat feeds.
Which TWO ways can you enrich events with threat intelligence in Splunk ES?
Custom lookups are a standard way to join threat intel data.
Why this answer
Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.
You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?
The Splunk Add-on for Microsoft Windows provides the correct sourcetypes and CIM mapping configuration out of the box.
Why this answer
To ensure CIM compliance, data should be mapped to the appropriate CIM tags and fields. Configuring the sourcetype correctly in props.conf and transforms.conf (or via the Add-on Builder) ensures the data is parsed and tagged into the Authentication data model correctly.
Which search command is used to join threat intelligence data with your local search results?
'lookup' is the preferred method for enriching events with threat intel.
Why this answer
The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.
What is the primary function of the 'Notable Event Suppression' feature?
The goal is to focus analysts on high-value alerts.
Why this answer
It allows users to prevent known false positives from creating notable events, reducing alert fatigue.
In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?
Risk Analysis configuration is where the risk score threshold for generating notable events is defined.
Why this answer
The Risk Notable Event threshold is configured within the Risk Analysis settings of the Splunk ES configuration menu.
Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?
The CIM Add-on provides the knowledge objects and schemas to normalize data.
Why this answer
The Splunk Common Information Model (CIM) is the framework that provides the schema for normalizing data across various sources.
When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?
Testing the query logic directly confirms if events exist.
Why this answer
Running the search query defined in the correlation search manually allows you to see if the search logic is returning any results.
Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?
The search head runs the scheduler that triggers notable events.
Why this answer
The 'Correlation Search' scheduler is the specific component that runs searches and triggers notable events.
You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?
Enabling acceleration creates the summary files necessary for fast reporting and correlation searches.
Why this answer
Acceleration must be enabled and the summary range must be set to cover the retention period required for security investigations.
Which TWO of the following are valid methods for enriching notable events in Splunk ES?
This framework is the standard ES method for adding context to notable events.
Why this answer
Lookups and Asset/Identity correlation are the primary methods for enriching events with context such as user roles or asset criticality.
Which TWO methods can be used to suppress notable events?
This is the underlying method for managing suppressions.
Why this answer
Suppression can be done via the UI (Incident Review) or by creating entries in the Notable Event Suppression lookup.
You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?
Suppression entries allow for granular filtering of notable events.
Why this answer
Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.
You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?
Risk factors are managed through these UI and data-driven methods.
Why this answer
The 'Risk Analysis' framework or 'Risk Scoring' configuration pages allow for modifying how scores are calculated for specific assets.
When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?
Urgency helps analysts prioritize the most critical incidents.
Why this answer
Urgency is a calculated value based on the risk of the event and the criticality of the assets involved, displayed in the Incident Review dashboard.
You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?
If the adaptive response action 'Notable' is not configured, the event remains a standard search result and is not promoted to the Incident Review dashboard.
Why this answer
The 'Notable' adaptive response action must be enabled in the correlation search configuration for it to generate an entry in the Incident Review dashboard.
A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?
Configuring the TZ at the indexer level ensures normalization upon ingestion.
Why this answer
Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.
Which TWO of the following are true regarding the configuration of notable events in Splunk ES?
Analysts can create custom notable events directly in the dashboard.
Why this answer
Notable events can be manually created via the UI, and their urgency is dynamically determined by the severity and impact settings.
Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?
Assigning owners is key to collaboration.
Why this answer
Analysts typically filter by status, urgency, and owner to manage their incident queue.
Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?
CIM Setup is the dedicated interface for managing add-on mappings.
Why this answer
The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.
What is the purpose of the 'Incident Review' dashboard in Splunk ES?
Incident Review is the workspace for security operations.
Why this answer
It serves as the central hub for security analysts to triage, investigate, and manage notable events.
Which TWO types of events are typically categorized as 'Notable Events'?
Analysts often create their own incidents for tracking.
Why this answer
Notable events are usually generated by high-fidelity correlation searches or by manual user creation in the Incident Review dashboard.
Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?
Acceleration is needed for ES dashboard performance.
Why this answer
Onboarding involves ensuring data is indexed, tagged for CIM compliance, and that the data model is accelerated to support ES dashboards.
When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?
The action assigns risk scores to entities, enabling risk-based alerting.
Why this answer
The Risk Analysis action adds risk events to the Risk Index, which allows for the aggregation of multiple low-fidelity alerts into a high-fidelity risk score for a specific entity.
A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?
The Incident Review dashboard provides a workflow for creating suppression rules for specific correlation searches.
Why this answer
Notable event suppression allows analysts to define criteria where events matching specific patterns (like a known scanner IP) are ignored, preventing them from appearing as notable events.
Ready to test yourself?
Try a timed practice session using only SIEM Defenses And Data Practices questions.