Which of the following is a way to test for a property normalized data model?
Which of the following is a way to test for a property normalized data model? A. Use Audit -> Normalization Audit and check the Errors panel. B. Run a | datamodel search, compare results to the CIM documentation for the datamodel. C. Run a | loadjob search, look at tag values and compare them to […]
Which setting is used in indexes.conf to specify alternate locations for accelerated storage?
Which setting is used in indexes.conf to specify alternate locations for accelerated storage? A. thawedPath B. tstatsHomePath C. summaryHomePath D. warmToColdScript Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels
Which indexes are searched by default for CIM data models?
Which indexes are searched by default for CIM data models? A. notable and default B. summary and notable C. _internal and summary D. All indexes Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html
What does the risk framework add to an object (user, server or other type) to indicate increased risk?
What does the risk framework add to an object (user, server or other type) to indicate increased risk? A. An urgency. B. A risk profile. C. An aggregation. D. A numeric score. Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskScoring
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency? A. VIP B. Priority C. Importance D. Criticality Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned
What role should be assigned to a security team member who will be taking ownership of notable events in the i
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard? A. ess_user B. ess_admin C. ess_analyst D. ess_reviewer Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents
In order to include an eventtype in a data model node, what is the next step after extracting the correct fiel
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields? A. Save the settings. B. Apply the correct tags. C. Run the correct search. D. Visit the CIM dashboard. Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches? A. Web B. Risk C. Performance D. Authentication Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html
What feature of Enterprise Security downloads threat intelligence data from a web server?
What feature of Enterprise Security downloads threat intelligence data from a web server? A. Threat Service Manager B. Threat Download Manager C. Threat Intelligence Parser D. Therat Intelligence Enforcement
When creating custom correlation searches, what format is used to embed field values in the title, description
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event? A. $fieldname$ B. “fieldname” C. %fieldname% D. _fieldname_ Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch