Discuss Splunk SPLK-3001 Exam Topic 2 Question 128

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

AEdit the search and modify the notable event status field to make the notable events less urgent.

BEdit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

CEdit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

DModify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Suggested Answer: B

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Arlette 2 months ago

I prefer option D. Adjusting urgency levels could help manage the events better.

Lorrine 2 months ago

Agreed, B seems logical. Less common matches reduce false positives.

Jeannine 2 months ago

I think option B is the best. Lowering the threshold makes sense.

Roxane 2 months ago

D sounds like a solid approach to manage urgency better.

Carey 2 months ago

A is a quick fix, but might not solve the root issue.

Reena 2 months ago

Surprised that urgency levels can be modified! Didn't know that was an option.

Nana 3 months ago

I disagree, C could lead to even more false positives.

Vilma 3 months ago

I think option B is the way to go. Lowering the threshold makes sense.

Tawna 3 months ago

I vaguely remember that making notable events less urgent could help with false positives, so maybe option A or D could be the answer.

Erick 3 months ago

I feel like the where or xswhere statements are key, but I can't recall if we should increase or decrease the threshold value.

Monroe 3 months ago

I think we practiced a similar question where we had to modify the urgency of notable events. I wonder if option D is the right choice here.

Therese 4 months ago

I remember discussing how adjusting the threshold values can help reduce false positives, but I'm not sure if it's about making it more or less common.

Splunk SPLK-3001 Exam - Topic 2 Question 128 Discussion