QUESTION: 5

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Map CIM to CEF fields.
Create a Splunk alert that uses the event_forward.py script to send events to Phantom.
Map CEF to CIM fields.
Create a saved search that generates the JSON for the new container on Phantom.

Answer(s): C

QUESTION: 6

A customer wants to design a modular and reusable set of playbooks that all communicate with each other. Which of the following is a best practice for data sharing across playbooks?

Use the py-postgresq1 module to directly save the data in the Postgres database.
Cal the child playbooks getter function.
Create artifacts using one playbook and collect those artifacts in another playbook.
Use the Handle method to pass data directly between playbooks.

Answer(s): A

Reveal Solution Next Question