Free Practice Questions for Splunk SPLK-3001 Exam

The Risk Analysis dashboard uses the Risk data model to populate the panels. The Risk data model is a data model that contains information about the risk scores and risk modifiers of various objects, such as systems, users, hashes, and network artifacts. The Risk data model accelerates these fields for the Risk Analysis and Incident Review dashboards. The Risk data model also handles case insensitive asset and identity correlation, allowing risk modifiers that are applied to system or user name variants to be correctly attributed to the same risk_object1. The other options, B, C, and D, are not correct. The Audit data model contains information about audit events, such as user logins, password changes, and system access. The Domain Analysis data model contains information about the domains that are visited by the systems in the network. The Threat Intelligence data model contains information about the threat intelligence sources, indicators, and matches. References =

Risk Analysis dashboard

Risk data model

Risk Analysis framework

Correlation searches can perform adaptive response actions when they find a pattern in the data. Adaptive response actions are automated or manual responses that you can use to modify your environment based on notable events. For example, you can block an IP address, add a user to a watchlist, or send an email notification. Configuring correlation adaptive responses is part of tuning correlation searches for a new ES installation, as it allows you to customize the actions that are triggered by the correlation searches. You can enable, disable, or modify the adaptive response actions for each correlation search, or create your own custom actions. References =

Configure correlation searches in Splunk Enterprise Security

Adaptive Response Framework overview

According to the Splunk Enterprise Security documentation, the first step when preparing to install ES is to determine the size and scope of installation. This involves estimating the amount of data that you plan to ingest, the number of users that will access ES, the number of search heads and indexers that you need, and the hardware requirements for each component. This step helps you plan your deployment architecture and ensure optimal performance and scalability of ES. Therefore, the correct answer is D. Determine the size and scope of installation. References = Deployment planning.

Recommended Actions show a list of Adaptive Responses to an analyst, which are possible actions that can be taken in response to a notable event. Adaptive Response Actions run automatically when a correlation search triggers a notable event, and can perform actions such as sending an email, adding a comment, or modifying a risk score. Recommended Actions are configured in the correlation search editor, while Adaptive Response Actions are configured in the alert actions manager. References =

Included adaptive response actions with Splunk Enterprise Security

Set up Adaptive Response actions in Splunk Enterprise Security

Configure adaptive response actions for a correlation search in Splunk Enterprise Security

The columns in the Assets lookup that are used to identify an asset in an event are ip, mac, dns, and nt_host. These columns contain the network identifiers of the assets, such as IP address, MAC address, DNS name, and NetBIOS name. Splunk Enterprise Security uses these columns to match the asset fields with the event fields, such as src, dest, dvc, host, and hostname. When a match is found, Splunk Enterprise Security enriches the event with the asset information, such as category, priority, business unit, and location. This allows you to search and analyze events based on the asset attributes and context. References =

Asset Lookup CSV file

Asset and identity correlation

Asset & Identity for Splunk Enterprise Security - Part 1 ...

Splunk Enterprise Security knows the local customer domain names so it can detect internal vs. external emails by using the Corporate Web and Email Domain Lookups. These are lookup files that contain the list of domains that are considered internal or corporate for the organization. The Corporate Web and Email Domain Lookups are edited during the initial configuration of Splunk Enterprise Security, and they are used to enrich events with the tag=internal_web or tag=internal_email fields. These fields indicate whether the web or email activity is internal or external, and they are used by dashboards and correlation searches in Splunk Enterprise Security to monitor and analyze the web and email traffic. References =

Corporate Web and Email Domain Lookups

Configure web and email domains in Splunk Enterprise Security

Detecting Typosquatting, Phishing, and Corporate Espionage ... - Splunk

According to the Splunk Enterprise Security documentation, the Distributed Configuration Management tool is used to update indexers in ES. This tool allows you to create and distribute a Splunk Enterprise Security app for indexers, which contains the necessary configurations for indexers to work with ES, such as index-time field extractions, tags, and event types. The app name is Splunk_ES_ForIndexers.spl and it is created by running the distributed_config_manager.py script on the search head. You can then deploy the app to the indexers using the deployment server or the cluster master. Therefore, the correct answer is B. Distributed Configuration Management. References = Distributed Configuration Management.

 The main purpose of the Dashboard Requirements Matrix document is to identify on which data model(s) each dashboard in Splunk Enterprise Security depends. The Dashboard Requirements Matrix document is a web page that lists all the dashboards in Splunk Enterprise Security and the data model datasets that populate them. The data model datasets are linked to the Common Information Model (CIM) documentation, which describes the tags, field names, and field values that the events must use to be CIM-compliant. The Dashboard Requirements Matrix document helps you to determine which data models you need to enable and accelerate for your Splunk Enterprise Security deployment, and which data sources you need to map to the data models using the technology add-ons. References =

Dashboard requirements matrix for Splunk Enterprise Security

Data models in the Splunk Common Information Model

The Status Configuration window in Splunk Enterprise Security allows you to manage and customize the investigation statuses and the status transitions for notable events. You can specify which roles can change the status of a notable event from one status to another. For example, you can restrict the ess_user role from changing the status of Resolved notable events to Closed by removing the ess_user role from the status transitions for the Closed status. This way, only the roles that have the permission to change the status to Closed can close the Resolved notable events. References =

Manage and customize investigation statuses in Splunk Enterprise Security