SPL Search Proficiency

A threat hunter wants to enrich firewall events with asset ownership data stored in a CSV lookup named asset_owners.csv, which maps dest_ip to owner and department. The lookup is already defined in transforms.conf. The hunter needs the owner and department fields added to each event. Which SPL search accomplishes this?

What is the purpose of the 'head' command?

A security analyst needs to create a search that identifies users who have logged in from more than three distinct countries within the last 24 hours, which could indicate compromised credentials. The authentication logs contain 'user' and 'src_country' fields. Which SPL search correctly identifies these users?

Which TWO of the following commands are used for data transformation or enrichment?

A defense analyst wants to correlate proxy logs and firewall logs to find internal hosts that contacted a known-malicious domain. The proxy logs store the field dest_host and the firewall logs store the field fqdn, and both indexes contain a common field src_ip. The analyst wants a single result set showing src_ip values present in both data sources for the same domain. Which SPL approach returns only hosts seen in both logs for matching domains?

A security analyst wants to extract the domain from a URL field in proxy logs to identify the most frequently accessed domains. The URL field contains values like 'https://www.example.com/path/page.html'. Which SPL command and function should the analyst use to extract just the domain?

An analyst is triaging a suspected brute-force attack and needs to view raw event text alongside a computed field showing how many seconds elapsed between consecutive failed logins from the same source IP. The events must remain individually visible, in time order, with the delta shown per event. Which SPL search best meets this need?

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

What is the purpose of the 'map' command in complex searches?

Which command is used to visualize data in a time-series chart?

A security analyst wants to correlate login and logout events for each user to calculate session durations. The events have fields 'user', 'action' (login or logout), and '_time'. Which SPL command sequence is most efficient to pair each login with the subsequent logout for the same user?

A security analyst is building a search to identify brute force attacks. They want to use the 'stats' command to calculate the count of failed login attempts per source IP, and then filter for IPs with more than 10 failures. They also want to include the earliest and latest timestamps of these failures. Which two SPL commands or functions should be used to achieve this? (Choose two.)

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

What is the result of using 'bin _time span=1d'?

You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?

Which THREE of the following are valid uses of the 'eval' command?

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

A security analyst wants to identify which users have logged in from more than one distinct country in the last 24 hours, a possible sign of credential compromise. The events contain user and src_country fields. Which SPL search best identifies these users?

Which THREE of the following are valid search operators?

A security analyst is investigating a potential data exfiltration event. They need to calculate the rate of outbound data transfer per source IP over the last 30 minutes, but the raw logs only contain cumulative byte counts per connection. Which SPL command sequence correctly computes the per-second rate of change for each src_ip?

Which THREE of the following represent valid ways to use the 'lookup' command?

A security analyst needs to quickly identify which users have logged in from more than three distinct source IP addresses in the last 24 hours. Which SPL command correctly calculates the number of distinct source IPs per user?

Which THREE commands can be used to handle or create statistical summaries?

Which command is used to rename a field in the results table for better readability?

A security analyst needs to correlate two event types for the same user within a 10-minute window: a 'login' event and a subsequent 'privilege_escalation' event. The events share a common field 'user'. Which SPL command should be used to join these events based on the user and time proximity?

What does the 'OR' operator do in a search?

A security analyst is writing SPL searches to detect suspicious activity and wants to understand which commands can be used to filter or transform search results. Which TWO of the following statements about SPL commands are accurate? (Choose two.)

An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?

Which TWO commands are helpful for identifying specific patterns in data?

Which THREE commands are used to manipulate multi-value fields?

Which THREE of the following are valid ways to filter events based on time?

A security analyst needs to identify all Windows event codes where the count of events exceeds 100 in the last 24 hours, and then display the results sorted by count in descending order. The base search returns events with the field 'EventCode'. Which SPL search accomplishes this?

When using 'stats', how can you include the values of a field as columns in your output?

A security analyst is investigating a potential insider threat and needs to see the number of events per hour for a specific user over the past 48 hours. The events are in the 'index=insider' with a field 'user'. Which SPL search will produce a time chart showing hourly event counts for that user?

A security analyst needs to identify the percentage of total authentication events that each user account generated over the past week. The search must return the user, the count of events for that user, and the percentage each user represents of all authentication events, sorted so the largest share appears first. Which SPL search accomplishes this?

Which command is used to append results from one search to another?

When dealing with multi-value fields, which command allows you to break them into individual events?

Which command is used to remove duplicate events based on a field?