MENU
A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.
What is a solution for this issue?
Suggested Answer: A
Get Premium SPLK-3001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
LO
Lottie
11 months ago
Disabling acceleration won't solve the false positive issue.
RO
Rossana
11 months ago
Surprised to see so many false positives from just one search!
GR
Grover
12 months ago
Changing severity could help, but is it really the best option?
BE
Beckie
12 months ago
I disagree, modifying the schedule might be better for accuracy.
NA
Nakisha
12 months ago
Suppressing notable events sounds like a quick fix.
CY
Cyndy
1 year ago
Suppressing events seems like a quick fix, but I wonder if it would just hide the problem instead of solving it.
MA
Marilynn
1 year ago
I feel like changing the default status and severity might be a good option, but I can't recall the exact implications of that.
EI
Eileen
1 year ago
I think modifying the correlation schedule could help reduce false positives, but I’m not entirely clear on how that works.
MA
Maurine
1 year ago
I remember we discussed suppressing notable events in class, but I’m not sure if that’s the best long-term solution.
OR
Oretha
1 year ago
Hmm, I'm a bit unsure about this one. The responsibilities cover a wide range of tasks, from development to deployment to monitoring. I'll need to carefully consider which principle best captures this end-to-end approach.
AL
Aleisha
1 year ago
Hmm, this seems like a tricky one. I'll need to carefully review the details about As Of Processing and the Partial Generation program to figure out which posted codes are actually processed and added to the F4112 file.