SPLK-5002Preview

An engineer adds a custom event status of 'Testing' and accidentally makes it the new default status. Their SOC calculates some metrics based on Notable status change sequences, starting from the old default status of 'New'. Which metrics can be affected by this mistake?

MITRE D3FEND™ is designed to compliment MITRE's list of adversarial tactics, techniques, and common knowledge (ATT&CK®). Which tactics are associated with MITRE D3FEND™ in order to detect, deny, and disrupt adversarial efforts?

Which fields are used to determine asset priority, when priority is assigned through an asset and identity lookup?

What external support consideration should an engineer account for if they plan to automate the disabling of a system or user?

Which of the following detections would use a high count of events with Windows Event Code 4740 grouped by a user to determine suspicious behavior?

When creating detections, which of the following sequences would result in the most performant SPL query?

What is one method used in ESCU content to calculate a risk score when creating a detection that uses the Risk Analysis adaptive response action?

Risk scores are associated with how many levels of risk in Enterprise Security by default?

When creating a detection, how might an engineer ensure that all possible contextual fields about a given asset and identity are added to a risk event?

Which REST call will show a list of alerts with their specific commands, app, and title?

When should a detection be reviewed or retuned after deployment?

Which of the following macro values will exclude all of the company networks if it is called from the following search? index=firewall sourcetype=pan:traffic NOT "company_networks"

Which of the following should be the primary reference when designing a new playbook in Splunk SOAR?

Which Enterprise Security components provide enrichment to the Risk Framework?

An engineer notices that a detection is creating multiple findings (notables) for the same potential incident. Which setting can be adjusted to reduce the number of generated findings (notables)?

Which of the following traces specific stages of an attack lifecycle?

The SOC Manager requested a better method to standardize the list of tasks that analysts follow when they evaluate events or cases. Which Splunk SOAR feature allows the creation of SOPs based on criteria like the type of event or attack vector?

An engineer wants to track and report on all authentication to corporate assets, and wants to prioritize critical assets without significantly increasing the number of findings (notable events) generated. What process could be used to accomplish this goal?

In order to perform a complete data assessment, an engineer's role within Splunk must have which of the following?

Which of the following identifies elements of the Detection Development Lifecyle (DDLC)?

When creating a detection that searches user activity across CIM-compliant data, which CIM field should be reviewed to ensure that data is aggregated appropriately?

An engineer has been working on building a new automation for the SOC. What Scope should be selected in the SOAR Playbook Debugger during the playbook development to ensure consistency?

Which of the following is the most efficient search to return a list of all visible indexes and the sourcetypes contained within them?

Which of the following cURL commands would allow an engineer to effectively disable the REST API endpoint they've been utilizing for testing a detection named TestSearchDevelopment?