Free Preparation Discussions
MENU
Splunk SPLK-5002 Exam - Topic 1 Question 1 Discussion
Topic #: 1
What are key elements of a well-constructed notable event? (Choose three)
A notable event in Splunk Enterprise Security (ES) represents a significant security detection that requires investigation.
Key Elements of a Good Notable Event: Meaningful Descriptions (Answer A)
Helps analysts understand the event at a glance.
Example: Instead of 'Possible attack detected,' use 'Multiple failed admin logins from foreign IP address'.
Proper Categorization (Answer C)
Ensures events are classified correctly (e.g., Brute Force, Insider Threat, Malware Activity).
Example: A malicious file download alert should be categorized as 'Malware Infection', not just 'General Alert'.
Relevant Field Extractions (Answer D)
Ensures that critical details (IP, user, timestamp) are present for SOC analysis.
Example: If an alert reports failed logins, extracted fields should include username, source IP, and login method.
Why Not the Other Options?
B. Minimal use of contextual data -- More context helps SOC analysts investigate faster.
Reference & Learning Resources
Building Effective Notable Events in Splunk ES: https://docs.splunk.com/Documentation/ES SOC Best Practices for Security Alerts: https://splunkbase.splunk.com How to Categorize Security Alerts Properly: https://www.splunk.com/en_us/blog/security
Carissa
2 months agoJenelle
2 months agoAliza
3 months agoOrville
3 months agoLindsey
3 months agoMing
3 months agoKarima
4 months agoCorinne
4 months agoPhung
4 months agoStanford
4 months agoBeth
4 months agoRene
5 months agoLyda
5 months agoClarence
10 months agoMartin
9 months agoRenea
10 months agoJerry
11 months agoWalker
11 months agoLazaro
11 months agoColeen
11 months agoIlene
10 months agoFiliberto
10 months agoSophia
10 months agoAlva
11 months agoKaitlyn
11 months agoTayna
11 months agoOlga
11 months agoClorinda
11 months agoBok
11 months agoAnnabelle
11 months agoDonte
11 months ago