A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?
Answer(s): A
https://docs.splunk.com/Documentation/ES/7.3.2/User/Triagenotableevents
Which SPL syntax would be used to perform statistical queries on indexed fields to calculate the cumulative total risk by the system or user in the most efficient way?
Answer(s): D
Using tstats with the summariesonly flag against the Risk data model leverages Splunk’s accelerated data model summaries to compute the cumulative risk score by object entirely from tsidx summaries, making it far more efficient than raw-event searches.
Which of the following is a reason to use Data Model Acceleration in Splunk?
Answer(s): B
Data Model Acceleration builds and maintains summary indexes (tsidx summaries) for your data models, allowing tstats and other accelerated searches to pull results directly from these summaries instead of scanning the full raw events - dramatically speeding up query performance.
Which Splunk app can help an organization inventory their data then find, deploy, and evaluate security detections to advance their security journey?
Splunk Security Essentials helps organizations inventory their data, map security use cases, and evaluate and deploy detections based on MITRE ATT&CK and other frameworks. It guides teams through their security journey by recommending relevant detections aligned with the data available in their Splunk environment.
What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?
https://attack.mitre.org/tactics/TA0011/
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members: