4.3 Format Event Data for User Readability, Export or Charting CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon Hunter is analyzing the geographic distribution of failed logon attempts. The event data includes a `Country` field. The hunter wants to present a visual that immediately shows which countries have the highest number of failed attempts. Which chart type is best suited for this geographical analysis?

   • AA scatter plot with latitude on the x-axis and longitude on the y-axis.
   • BA map chart with countries shaded by the count of failed attempts.
   • CA line chart with time on the x-axis and failed attempts on the y-axis.
   • DA pie chart showing the proportion of failed attempts by country.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A Falcon hunter wants to create a chart that shows the relative proportion of different event types (e.g., Process Creation, Network Connection) within a search result set. Which chart type is best suited for this?

   • APie chart
   • BArea chart
   • CLine chart
   • DHistogram
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon Hunter is investigating a phishing campaign and wants to present the findings to the executive team. The hunter has a query that returns a list of affected users and the number of times each user clicked a malicious link. The executive team wants a single visual that clearly shows which users are most affected. Which visualization is most appropriate for this data?

   • AA scatter plot with username on the x-axis and click count on the y-axis.
   • BA table with the raw data exported to CSV.
   • CA horizontal bar chart with usernames on the y-axis and click counts on the x-axis.
   • DA line chart with time on the x-axis and click counts on the y-axis.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A hunter needs to export event data in a format that preserves nested structures and is commonly used for API integrations. Which format should they choose?

   • AXML
   • BCSV
   • CJSON
   • DTXT
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is monitoring for a potential brute-force attack. They have a query that returns thousands of failed logon events with timestamps. The team lead wants to quickly see if the frequency of failures is increasing over the last 24 hours to determine if the attack is accelerating. Which Event Search feature should the hunter use to best visualize this trend?

   • AUse a bar chart with each bar representing a different username targeted by the attack.
   • BCreate a line chart with the event timestamp on the x-axis and the count of events on the y-axis.
   • CExport the raw events to CSV and manually count the events per hour in a spreadsheet.
   • DCreate a pie chart showing the proportion of failed logons by source IP address.
   Reveal Solution Discussion Select an answer first