Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A detection engineer has created a new correlation search that triggers a notable event when a user downloads more than 100 MB of data in 10 minutes. Before enabling it in production, the engineer wants to validate that the search works correctly and produces the expected notable events. Which approach is the most appropriate for validation?

   • AAsk another engineer to review the search syntax without running it.
   • BRun the search manually over a known time range with test data and verify that the notable events are generated with the correct attributes.
   • CEnable the search in production and monitor the Incident Review queue for the first week to see if events look correct.
   • DCreate a test notable event manually and check that it appears in the Incident Review interface.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of configuring a webhook action on a notable event?

   • ATo send the notable event data to an external system, such as a ticketing or orchestration platform
   • BTo store the notable event in a separate index for long-term retention
   • CTo automatically resolve the notable event without analyst intervention
   • DTo create a visual representation of the event in a dashboard
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a typical action an analyst can perform on a notable event in Incident Review?

   • AModify the underlying correlation search's logic
   • BDelete the raw log data that triggered the event
   • CChange the event's status to 'In Progress' or 'Resolved'
   • DChange the index where the event is stored
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a correlation search, which component is responsible for turning the search results into a notable event?

   • AThe search head's distributed search feature
   • BThe 'notable' action defined in the correlation search
   • CThe alert action's email configuration
   • DThe indexer's data summarization
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A correlation search generates notable events for suspicious authentication activity. The analyst wants to enrich each notable event with the user's department and manager from a CSV file stored in Splunk. The CSV has fields `user`, `department`, and `manager`. Which approach should the analyst use to add this context to the notable event?

   • ACreate a separate correlation search that runs after the main one and updates the notable events with the CSV data.
   • BAdd a `lookup` command in the correlation search to join the CSV data on the `user` field, then include the `department` and `manager` fields in the notable event's 'Description' or 'Custom Details'.
   • CUse the 'Enrichment' tab in the notable event action settings to automatically add the CSV fields to the event.
   • DManually update each notable event in the Incident Review interface with the department and manager information.
   Reveal Solution Discussion Select an answer first