A threat hunter is analyzing incoming emails during the past 30 days, looking for spam or phishing campaigns targeting many users. This involves finding large numbers of similar, but not necessarily identical, emails.The hunter extracts key datapoints from each email record, including the sender's address, recipient's address, subject, embedded URLs, and names of any attachments. Using the Splunk App for Data Science and Deep Learning, they then visualize each of these messages as points on a graph, looking for large numbers of points that occur close together.This is an example of what type of threat-hunting technique?
Answer(s): B
By representing each email as a point in a multi-dimensional space (based on sender, recipient, subject, URLs, attachments, etc.) and then identifying groups of points that lie close together, the hunter is using clustering to find batches of similar emails indicative of a campaign.
Splunk detections can be mapped to their appropriate MITRE ATT&CK® Techniques using which feature?
Answer(s): C
In Splunk Enterprise Security, correlation searches and other detections include annotation fields where you map each detection to its corresponding MITRE ATT&CK® tactic and technique IDs. These Annotations are what drive the ATT&CK mapping in dashboards and reports.
An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?
Answer(s): D
https://docs.splunk.com/Documentation/MC/Current/Detect/RiskEvents
An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?
https://community.splunk.com/t5/Splunk-Search/How-to-find-failed-Logons-by-IP-Address-and-by-Username/m-p/228505
Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times:147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733What kind of attack is occurring?
https://www.baeldung.com/cs/http-flood-attacks
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5001 content, but please register or login to continue.