Splunk Exam SPLK-3001 Topic 3 Question 15 Discussion

Actual exam question for Splunk's SPLK-3001 exam

Question #: 15
Topic #: 3

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

AEdit the search and modify the notable event status field to make the notable events less urgent.

BEdit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

CEdit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

DModify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Show Suggested Answer

Suggested Answer: B

by Larae at May 06, 2022, 07:50 AM

Limited Time Offer

25%

Off

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!