MENU
What are essential practices for generating audit-ready reports in Splunk? (Choose three)
Audit-ready reports help demonstrate compliance with security policies and regulations (e.g., PCI DSS, HIPAA, ISO 27001, NIST).
1. Including Evidence of Compliance with Regulations (A)
Reports must show security controls, access logs, and incident response actions.
Example:
A PCI DSS compliance report tracks privileged user access logs and unauthorized access attempts.
2. Ensuring Reports Are Time-Stamped (C)
Provides chronological accuracy for security incidents and log reviews.
Example:
Incident response logs should include detection, containment, and remediation timestamps.
3. Automating Report Scheduling (D)
Enables automatic generation and distribution of reports to stakeholders.
Example:
A weekly audit report on security logs is auto-emailed to compliance officers.
Incorrect Answers:
B . Excluding all technical metrics Security reports must include event logs, IP details, and correlation results.
E . Using predefined report templates exclusively Reports should be customized for compliance needs.
Additional Resources:
Splunk Compliance Reporting Guide
Automating Security Reports in Splunk