SIEM Defenses And Data Practices practice questions

The local/inputs.conf file.

Why it fails: This configures inputs, not normalization mappings.

Splunk ES > Configure > Data Enrichment.

Why it fails: This is for lookups and enrichment, not model normalization.

Settings > Data Model acceleration.

Why it fails: This only manages acceleration, not the full CIM configuration.

Encrypt the notable events in the KV Store.

Why it fails: The KV Store does not provide granular field-level access control.

Hide the notable event in the Incident Review dashboard.

Why it fails: This does not prevent access via search.

Change the notable event severity to 'Informational'.

Why it fails: Severity does not control access permissions.

Asset Discovery.

Why it fails: This is for managing the asset inventory.

Threat Intelligence Manager.

Why it fails: This is for managing threat feeds.

Incident Review.

Why it fails: Incident Review is for managing notable events.

Using a crontab on the OS level.

Why it fails: The Threat Intelligence framework's update interval is set within Splunk's own threat intelligence configuration, not the host scheduler; a crontab runs OS commands and cannot alter framework refresh timing. Crontab is tempting because it genuinely schedules recurring OS-level tasks, such as scripted lookups or feed downloads, which is a valid approach for custom external automation.

By modifying the threat data model.

Why it fails: The threat data model defines field extractions and object structure for intelligence, not refresh scheduling, so editing it changes no update timing. It is tempting because the data model underpins how threat objects are indexed and searched, and modifying it is the correct action when you need new fields or accelerated intelligence correlation.

In the global settings.conf file.

Why it fails: Global settings.conf holds system-wide Splunk configuration, but the Threat Intelligence framework reads its interval from its own dedicated intelligence settings, so edits there have no effect. It is tempting because settings.conf legitimately governs many cluster-wide defaults, and is the right place for those general settings rather than feed refresh timing.

user

Why it fails: user is mandatory in the Authentication and Endpoint data models, not Network Traffic, so supplying it alone will not categorise the event. It is tempting because identity fields often appear in proxy and firewall logs, but the Network Traffic model requires src, dest and user together, not user in isolation.

src_ip

Why it fails: src_ip is a valid CIM alias but not one of the Network Traffic model's mandatory fields; the model requires src, dest and user, so src_ip alone cannot categorise the event. It is tempting because source addresses appear in nearly every network log, yet the constraint is the required field set, not field presence.

host

Why it fails: The Network Traffic data model's mandatory fields are src, dest and user; host is not required, so tagging on host alone leaves events uncategorised. It is tempting because host is mandatory in the Endpoint data models, where it identifies the reporting device, but that requirement does not transfer to network flow data.

Restarting the search head cluster.

Why it fails: Restarting does not suppress events.

Renaming the index.

Why it fails: Renaming indexes does not suppress events.

Adding a block to the inputs.conf.

Why it fails: This only controls data collection, not event generation.

Disable all other Splunk apps.

Why it fails: Disabling other Splunk apps removes correlation searches, data models and dashboards that ES depends on, breaking onboarding. It is tempting as a way to reduce noise, and would be correct only when troubleshooting app conflicts, not for adding a data source.

Create a custom indexer cluster.

Why it fails: Creating a custom indexer cluster is infrastructure work unrelated to data-source onboarding; ES uses the existing indexer tier. It is tempting because indexing capacity matters for new data, and would be correct when scaling search performance, not when configuring a source.

Disable the correlation search and create a new one with an exclusion filter.

Why it fails: Disabling and rebuilding the search discards its existing configuration and scheduling, and the exclusion must still be authored; editing the search's own filter achieves the same suppression in place. It is tempting because disabling genuinely stops all firing, which would be correct if the search were obsolete rather than merely noisy.

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Why it fails: An eval statement computes a new field after the search has already matched events, so the scanner still generates notables; filtering must occur earlier in the pipeline. It is tempting because eval genuinely transforms results, and would be correct when deriving a calculated field for enrichment rather than excluding matching events.

Change the risk score of the notable event to zero in the correlation search configuration.

Why it fails: Zeroing the risk score suppresses the notable's contribution to risk but leaves the notable itself firing, so the analyst's queue stays noisy. It is tempting because risk-based alerting genuinely prioritises by score, and would be correct if the goal were to deprioritise rather than stop the scanner's notables.

Incident Review Dashboard

Why it fails: This dashboard displays events, it does not configure global thresholds.

Configure > Content > Correlation Searches

Why it fails: Individual searches are managed here, not the global threshold.

The Security Posture dashboard

Why it fails: This dashboard provides a visualization of the security state, not configuration options.

The data must be sent to the 'main' index.

Why it fails: ES can ingest data from any index.

The data must be converted to JSON format.

Why it fails: Splunk can handle many formats; JSON is not a prerequisite.

All notable events must be stored in the 'notable' index.

Why it fails: Notable events are written to the notable index by default, but Splunk ES permits this destination to be changed, so the requirement is not absolute. It is tempting because the notable index is the standard location, yet the statement's 'must' overstates a configurable default.

Notable events are immutable and cannot be updated after creation.

Why it fails: Notable events are mutable: analysts can update status, owner, urgency and add comments, and correlation search settings can be edited. It is tempting because the underlying event data is immutable in the index, but the notable event itself is a mutable knowledge object stored in the KV store, so updates are expected during investigation.

Notable events can only be generated by correlation searches.

Why it fails: Notable events can also be created manually by analysts, via the notable event API, or through other alert actions, not solely by correlation searches. It is tempting because correlation searches are the primary generator in Enterprise Security, but manual creation and API ingestion are supported paths for ad-hoc or external detections.

Change the search to summariesonly=false so tstats reads raw events in addition to the acceleration summary.

Why it fails: Setting summariesonly=false does allow tstats to fall back to raw events, but it masks the underlying acceleration coverage problem rather than resolving it. The scenario states acceleration is enabled and complete, so the correct diagnostic step is to verify the summary's time range. Disabling summariesonly also degrades performance, defeating the purpose of acceleration.

Re-run the data model acceleration job manually because a 100% completion rate does not guarantee the summary is queryable.

Why it fails: A 100% completion rate does indicate the acceleration job finished successfully and the summary should be queryable for the covered time range. Re-running the job would not add data outside the configured summary range and is unnecessary. The issue is coverage, not job failure, so this action does not address the scenario.

Verify that the Authentication data model's root search event constraints match the sourcetype and index of the raw authentication events.

Why it fails: If the constraints were wrong, the accelerated summary would also be empty, but the scenario indicates acceleration completed without error. Constraint mismatches typically produce no acceleration at all, not a partial gap. While constraints are important, the described symptom of raw events existing while accelerated queries return zero points more directly to summary time-range coverage.

index=notable | search orig_event_id=* | map search="index=* event_id=$orig_event_id$"

Why it fails: Using map to search all indexes for the event_id can be resource-intensive and may not be accurate if the event_id field is not consistently named. Splunk ES provides a more direct method to retrieve original events.

index=notable | search orig_event_id=* | lookup ...

Why it fails: Searching the notable index for orig_event_id will only return the notable event itself, not the raw events. The orig_event_id is a reference to the original event, but the notable index does not contain the raw data.

index=* | search event_id=orig_event_id

Why it fails: Searching all indexes for event_id equal to the orig_event_id is inefficient and may not work because the field name for the original event ID may vary. The orig_event_id is typically used with a specific lookup or macro.

Create a new index for the data and set the retention policy.

Why it fails: Creating a new index and setting retention is a general Splunk administration task, but it is not specific to ES normalization. While it may be necessary for data storage, it does not ensure the data is mapped to CIM, which is the key requirement for ES to use the data in correlation searches.

Add the source to the Identity lookup table to resolve user identities.

Why it fails: Adding to the Identity lookup helps with identity resolution but is not a mandatory step for all log sources. It is only relevant for sources containing user identity information, and it does not normalize the data for CIM. Therefore, it is not a general requirement for onboarding a new log source.

Configure a new correlation search to test the data.

Why it fails: Configuring a correlation search is not a required step for data onboarding; it is part of detection engineering. While testing with a search is good practice, it is not a mandatory action to make the data usable by ES. The focus should be on normalization and acceleration.

Data model acceleration with a custom constraint

Why it fails: Data model acceleration speeds up searches on data models, but it does not provide a mechanism to correlate events across different indexes with a time constraint. While you could create a data model that includes both authentication and file share data, the correlation logic and time window must be defined in a correlation search, not in the data model itself. This option does not directly solve the correlation requirement.

Correlation search with a join or append subsearch

Why it fails: While a correlation search can include join or append subsearches to combine data from multiple indexes, these commands have limitations: they can be resource-intensive and may not handle time-based correlation efficiently. The scenario requires a time constraint between two events, which is better addressed by the correlation search's built-in time window and the use of the 'transaction' command within the search, but the correlation search itself is the feature that enables this.

Transaction search with a maxspan of 10 minutes

Why it fails: A transaction search groups events that share a common field, such as a user, and can enforce a maxspan. However, it is not the primary correlation mechanism in Splunk ES for creating notable events; correlation searches are designed for this purpose and provide built-in risk analysis and adaptive response actions. Using a transaction search here would not integrate with the ES notable event framework as intended.

Add the source type to the data model's acceleration whitelist in the Data Model Editor.

Why it fails: Data model acceleration does not use a source type whitelist; it accelerates based on the data model's constraints, which are defined by its root event search and child searches. Simply adding a source type to an acceleration whitelist is not a supported configuration and would not cause the firewall logs to be included in the accelerated data model.

Modify the firewall logs' sourcetype to match an existing Network_Traffic source type.

Why it fails: Changing the sourcetype of the firewall logs to match an existing one is not recommended; it can break other searches and field extractions. The proper method is to update the data model's root event search to include the new sourcetype while keeping the original sourcetype intact. This ensures accurate mapping without disrupting other data flows.

Create a new tag for the firewall logs and add it to the Network_Traffic data model.

Why it fails: Tags are used for event categorization and can be referenced in data model constraints, but simply creating a tag does not automatically add the logs to the data model. The data model's root event search must explicitly include the events, either by source type, tag, or other search terms. Without updating the root search, the tag alone is insufficient.

The correlation search schedule is set to run every minute.

Why it fails: The schedule frequency of a correlation search affects how often notable events are generated, but it does not control whether risk scores are updated. Risk scores are updated when risk rules are triggered by notable events. A more frequent schedule might generate more events, but if risk rules are missing or misconfigured, scores will still not increase.

The Risk Analysis adaptive response action is enabled in the correlation search.

Why it fails: The Risk Analysis adaptive response action is used to manually or automatically modify risk scores, but it is not required for risk framework entries to update scores. Risk framework entries are updated by the correlation search's risk rules, not by the adaptive response action. Enabling this action would not resolve the issue if the risk rules are misconfigured.

The notable event's urgency is set to High or Critical.

Why it fails: Urgency affects the priority and display of notable events but does not directly control risk score updates. Risk scores are updated based on risk rules, not urgency. Even if urgency is low, risk rules should still apply if configured correctly. Therefore, checking urgency is not the first step to resolve the risk score issue.

Splunk ES Correlation Search with a join subsearch using the user field.

Why it fails: Using a join subsearch can correlate events, but it is inefficient for large datasets and may hit subsearch limits. Splunk ES provides a more integrated feature for this purpose. The join command is not the preferred method for correlation searches because it can be slow and does not leverage ES's optimized correlation capabilities.

Splunk ES Asset and Identity framework to enrich user data.

Why it fails: The Asset and Identity framework enriches events with contextual information like user details, but it does not correlate events across indexes based on time windows. It is used for lookup and enrichment, not for joining disparate events. This scenario requires temporal correlation, which is beyond the scope of asset and identity lookups.

Transaction search command with startswith and endswith options.

Why it fails: The transaction command groups events into transactions based on fields and time constraints, but it is not optimized for correlation searches in Splunk ES and can be resource-intensive. It also does not natively integrate with the ES notable event framework or the correlation search scheduling. While it can join events, it is not the recommended feature for cross-index correlation in ES.

The correlation search is missing a throttle configuration, causing it to skip execution.

Why it fails: A missing throttle configuration does not cause a correlation search to skip execution; it may lead to duplicate notables if the search triggers multiple times on the same data. Throttling is used to suppress repeated notables for the same condition within a specified period. The absence of throttling would not prevent notables from being generated altogether; it would only affect the volume of notables.

The 'stats' command is not supported in correlation searches.

Why it fails: The 'stats' command is fully supported in correlation searches and is commonly used to aggregate events. The issue is not with the command itself but with the scheduling and time range. Using 'stats' to count failures is a valid approach; the missing notables are more likely due to the search window not capturing all relevant events because of indexing delays.

The correlation search is not enabled in the ES configuration.

Why it fails: If the correlation search were not enabled, it would not run at all, and no notables would be generated. However, the scenario implies the search is running but not producing notables. While it's good to verify enablement, the specific symptom of missing notables despite raw events suggests a logic or timing issue rather than a disabled search. This is a plausible check but not the most likely cause given the details.

Risk analysis framework with a risk score threshold

Why it fails: Risk analysis assigns risk scores to entities but does not directly control when a correlation search generates a notable event. It aggregates risk from multiple sources and can trigger notables via risk-based correlation searches, but it does not provide a simple threshold mechanism for counting failed logins from a single IP within a time window. Configuring risk analysis would not meet the specific requirement of suppressing notables until 10 failures occur in 5 minutes. It is used for prioritization, not for direct event throttling based on raw event counts.

Adaptive response action to automatically block the source IP

Why it fails: Adaptive response actions execute automated tasks like blocking an IP, but they do not control the generation of notable events. They are triggered after a notable is created, not before. Using an adaptive response would not prevent the notable from being created for each failed login; it would only act upon them. The requirement is to reduce noise by only creating notables when a threshold is met, so adaptive response is not the appropriate feature. It addresses response, not detection logic.

Correlation search scheduling with a cron expression that runs every 5 minutes

Why it fails: Changing the schedule to run every 5 minutes would batch events, but it would not enforce a threshold of 10 failures from the same IP. The search would still generate a notable for any number of failures, just less frequently. It does not provide the conditional logic to only alert when the count exceeds 10. Scheduling affects timing, not the condition for notable creation. Therefore, it does not meet the requirement of suppressing notables until the threshold is reached.