Free Preparation Discussions
MENU
Splunk SPLK-5002 Exam - Topic 5 Question 2 Discussion
Topic #: 5
An engineer observes a high volume of false positives generated by a correlation search.
What steps should they take to reduce noise without missing critical detections?
How to Reduce False Positives in Correlation Searches?
High false positives can overwhelm SOC teams, causing alert fatigue and missed real threats. The best solution is to fine-tune suppression rules and refine thresholds.
How Suppression Rules & Threshold Tuning Help: Suppression Rules: Prevent repeated false positives from low-risk recurring events (e.g., normal system scans). Threshold Refinement: Adjust sensitivity to focus on true threats (e.g., changing a login failure alert from 3 to 10 failed attempts).
Example in Splunk ES: Scenario: A correlation search generates too many alerts for failed logins. Fix: SOC analysts refine detection thresholds:
Suppress alerts if failed logins occur within a short timeframe but are followed by a successful login.
Only trigger an alert if failed logins exceed 10 attempts within 5 minutes.
Why Not the Other Options?
A. Increase the frequency of the correlation search -- Increases search load without reducing false positives. C. Disable the correlation search temporarily -- Leads to blind spots in detection. D. Limit the search to a single index -- May exclude critical security logs from detection.
Reference & Learning Resources
Splunk ES Correlation Search Optimization Guide: https://docs.splunk.com/Documentation/ES Reducing False Positives in SOC Workflows: https://splunkbase.splunk.com Fine-Tuning Security Alerts in Splunk: https://www.splunk.com/en_us/blog/security
Ira
2 months agoRemona
2 months agoWynell
3 months agoAhmed
3 months agoJosefa
3 months agoShaun
3 months agoDexter
4 months agoAlida
4 months agoClay
4 months agoShayne
4 months agoWillis
4 months agoBarney
5 months agoHector
5 months agoDorian
10 months agoAlpha
10 months agoJettie
9 months agoDeeanna
9 months agoMagda
11 months agoTammara
11 months agoJaney
11 months agoCarey
9 months agoPeter
9 months agoJesusita
9 months agoGeoffrey
9 months agoJamika
9 months agoLashanda
9 months agoAlesia
10 months agoMichell
10 months agoGlendora
11 months agoElvera
11 months agoLaila
10 months agoJackie
10 months agoTwana
10 months agoVanda
11 months agoCarlota
10 months agoJose
10 months agoLeonora
11 months ago