QUESTION: 25

What does a user need to do to have a container with an event from Splunk use context- aware actions designed for notable events?

Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
Rename the event_id field from the notable event to splunkNotableEventld.
Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

Answer(s): D

Reveal Solution Next Question

QUESTION: 26

How can a child playbook access the parent playbook's action results?

Child playbooks can access parent playbook data while the parent Is still running.
By setting scope to ALL when starting the child.
When configuring the playbook block in the parent, add the desired results in the Scope parameter.
The parent can create an artifact with the data needed by the did.

Answer(s): B

Reveal Solution Next Question

QUESTION: 27

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?