Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk SPLK-5002 Exam - Topic 5 Question 2 Discussion

An engineer observes a high volume of false positives generated by a correlation search.What steps should they take to reduce noise without missing critical detections?
B) Add suppression rules and refine thresholds.
A) Increase the frequency of the correlation search.
C) Disable the correlation search temporarily.
D) Limit the search to a single index.

Splunk SPLK-5002 Exam - Topic 5 Question 2 Discussion

Actual exam question for Splunk's SPLK-5002 exam
Question #: 2
Topic #: 5
[All SPLK-5002 Questions]

An engineer observes a high volume of false positives generated by a correlation search.

What steps should they take to reduce noise without missing critical detections?

Show Suggested Answer Hide Answer
Suggested Answer: B

How to Reduce False Positives in Correlation Searches?

High false positives can overwhelm SOC teams, causing alert fatigue and missed real threats. The best solution is to fine-tune suppression rules and refine thresholds.

How Suppression Rules & Threshold Tuning Help: Suppression Rules: Prevent repeated false positives from low-risk recurring events (e.g., normal system scans). Threshold Refinement: Adjust sensitivity to focus on true threats (e.g., changing a login failure alert from 3 to 10 failed attempts).

Example in Splunk ES: Scenario: A correlation search generates too many alerts for failed logins. Fix: SOC analysts refine detection thresholds:

Suppress alerts if failed logins occur within a short timeframe but are followed by a successful login.

Only trigger an alert if failed logins exceed 10 attempts within 5 minutes.

Why Not the Other Options?

A. Increase the frequency of the correlation search -- Increases search load without reducing false positives. C. Disable the correlation search temporarily -- Leads to blind spots in detection. D. Limit the search to a single index -- May exclude critical security logs from detection.

Reference & Learning Resources

Splunk ES Correlation Search Optimization Guide: https://docs.splunk.com/Documentation/ES Reducing False Positives in SOC Workflows: https://splunkbase.splunk.com Fine-Tuning Security Alerts in Splunk: https://www.splunk.com/en_us/blog/security


by Fairy at Mar 21, 2025, 02:24 PM

Limited Time Offer

25%

Off

Get Premium SPLK-5002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Ira
7 months ago
Wait, disabling the search? That sounds risky!
upvoted 0 times
...
Remona
7 months ago
I think D could help, but it might miss important data.
upvoted 0 times
...
Wynell
7 months ago
B is the best option, gotta refine those thresholds!
upvoted 0 times
...
Ahmed
7 months ago
A is not the answer, that just increases noise!
upvoted 0 times
...
Josefa
8 months ago
Definitely B, suppression rules are key!
upvoted 0 times
...
Shaun
8 months ago
Suppression rules and refining thresholds sound familiar from practice questions, but I wonder if there's a better approach than just disabling the search temporarily.
upvoted 0 times
...
Dexter
8 months ago
Increasing the frequency of the correlation search seems counterintuitive if we're trying to reduce noise. I feel like that could just make things worse.
upvoted 0 times
...
Alida
8 months ago
I think limiting the search to a single index might help, but it could also risk missing some important detections.
upvoted 0 times
...
Clay
9 months ago
I remember we discussed how adding suppression rules can help reduce false positives, but I'm not entirely sure how to refine the thresholds effectively.
upvoted 0 times
...
Shayne
9 months ago
Limiting the search to a single index could be a good idea, but I'd want to make sure that's not going to cause us to miss anything important. Gotta be careful with that one.
upvoted 0 times
...
Willis
9 months ago
Disabling the correlation search temporarily doesn't seem like the right approach - we need to find a way to make it work better, not just turn it off.
upvoted 0 times
...
Barney
9 months ago
Okay, I think the key here is to find a way to refine the thresholds and add suppression rules. That should help cut down on the false positives without losing the important stuff.
upvoted 0 times
...
Hector
9 months ago
Hmm, this seems like a tricky one. I'd want to carefully consider the trade-offs between reducing noise and missing critical detections.
upvoted 0 times
...
Dorian
1 year ago
I think disabling the correlation search temporarily could also be a good option to consider.
upvoted 0 times
...
Alpha
1 year ago
Option B is the clear winner here. Refining the thresholds is key to getting that signal-to-noise ratio under control.
upvoted 0 times
Jettie
1 year ago
User 2: Agreed, that should help reduce the false positives.
upvoted 0 times
...
Deeanna
1 year ago
User 1: I think we should go with option B and refine the thresholds.
upvoted 0 times
...
...
Magda
1 year ago
But wouldn't limiting the search to a single index also help?
upvoted 0 times
...
Tammara
1 year ago
I agree with Glendora, that could help reduce false positives.
upvoted 0 times
...
Janey
1 year ago
I'd go with Option D. Limiting the search to a single index seems like a quick and easy way to cut down on the false positives.
upvoted 0 times
Carey
1 year ago
Disabling the correlation search temporarily could be risky, we might miss critical detections.
upvoted 0 times
...
Peter
1 year ago
Increasing the frequency of the correlation search might overwhelm the system with more false positives.
upvoted 0 times
...
Jesusita
1 year ago
I think adding suppression rules and refining thresholds could also be helpful in reducing noise.
upvoted 0 times
...
Geoffrey
1 year ago
Option D sounds like a good idea. It could help reduce the false positives.
upvoted 0 times
...
Jamika
1 year ago
Disabling the correlation search temporarily could be risky, we might miss critical detections.
upvoted 0 times
...
Lashanda
1 year ago
Increasing the frequency of the correlation search might overwhelm the system with more false positives.
upvoted 0 times
...
Alesia
1 year ago
I think adding suppression rules and refining thresholds could also be helpful in reducing noise.
upvoted 0 times
...
Michell
1 year ago
Option D sounds like a good idea. It could help reduce the false positives.
upvoted 0 times
...
...
Glendora
1 year ago
I think we should add suppression rules and refine thresholds.
upvoted 0 times
...
Elvera
1 year ago
Haha, disabling the correlation search? That's like trying to fix a broken window by boarding it up completely. Option B is the way to go.
upvoted 0 times
Laila
1 year ago
User 3: Increasing the frequency of the correlation search might just overwhelm us with more noise.
upvoted 0 times
...
Jackie
1 year ago
User 2: Definitely, that way we can reduce the false positives without missing important detections.
upvoted 0 times
...
Twana
1 year ago
User 1: I agree, adding suppression rules and refining thresholds is the best approach.
upvoted 0 times
...
...
Vanda
1 year ago
Option B looks good to me. Adjusting the suppression rules and thresholds should help reduce the noise without missing important detections.
upvoted 0 times
Carlota
1 year ago
User 3: Limiting the search to a single index might also help in reducing noise without missing critical detections.
upvoted 0 times
...
Jose
1 year ago
User 2: I think increasing the frequency of the correlation search could also be a good idea to catch any missed detections.
upvoted 0 times
...
Leonora
1 year ago
User 1: I agree, adjusting suppression rules and thresholds can definitely help with reducing false positives.
upvoted 0 times
...
...

Save Cancel