Outline the Purpose and Scope of Annotations Within Splunk Enterprise Security. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an incident investigation, an analyst wants to record the timestamp when a suspicious IP address was first observed, the name of the threat intel feed that flagged it, and a free-text note about the analyst's hypothesis. The analyst needs all of this information to be attached to the notable event for the audit trail. What is the most appropriate way to capture this information in Splunk Enterprise Security?

   • ARecord the information in a separate spreadsheet and link it to the notable event ID.
   • BAdd the information to the event's raw data using a data model update.
   • CCreate three separate annotations: one for the timestamp, one for the feed, and one for the hypothesis.
   • DUse a single annotation with structured fields for the timestamp and feed, plus a text field for the hypothesis.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC is investigating a notable event that was generated by a correlation search. The analyst has confirmed the event is a true positive and wants to add context that includes the affected user's department, the severity level assigned by the team lead, and a note about the remediation steps taken. The analyst also wants to ensure this context is visible to the incident response team that will handle the case. What is the most efficient way to achieve this?

   • AUpdate the correlation search to include the department and severity in the event's title.
   • BAdd a single annotation with fields for department, severity, and remediation notes.
   • CAdd three separate annotations: one for department, one for severity, and one for remediation.
   • DCreate a new notable event with the context and link it to the original.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is triaging a notable event and wants to add a note that the affected asset is a domain controller, along with the asset's criticality level and the name of the asset owner. What is the best way to capture this contextual information in Splunk Enterprise Security?

   • AUpdate the asset's identity record in the Assets and Identities framework.
   • BWrite the information in the event's raw log using a custom field extraction.
   • CAdd an annotation with fields for asset type, criticality, and owner.
   • DCreate a new notable event with the asset details and link it to the original.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC manager wants to standardize how analysts document their findings on notable events. The manager wants to ensure that all annotations include the analyst's name, the date, and a summary of the investigation. What is the best way to enforce this standardization?

   • AUse a custom script to validate annotations and reject those missing required fields.
   • BDisable annotations and require analysts to document findings in a separate log.
   • CConfigure a required fields setting for annotations in Splunk ES.
   • DCreate a runbook or SOP that instructs analysts to include these fields in every annotation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following best describes how annotations contribute to the investigation process in Splunk Enterprise Security?

   • AThey encrypt the notable event data to protect it from unauthorized access
   • BThey replace the need for correlation searches in detecting threats
   • CThey automatically remediate security incidents without analyst intervention
   • DThey provide a historical record of analyst observations and decisions for future reference
   Reveal Solution Discussion Select an answer first