SPLK-5002 무료 덤프문제 온라인 액세스

A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?

• A.Use a SOAR playbook to handle the Splunk Attack Analyzer submission and data collection steps, and make this information available to an assigned analyst.
• B.Automatically send all findings containing the tag "phishing" to create an email notification for the SOC.
• C.Use a SOAR playbook to submit the email to PhishTank, which will automatically handle the Splunk Attack Analyzer submission, and make this information available to an assigned analyst.
• D.Automatically assign findings containing the tag "phishing" to analysts to speed up the start of data collection steps and reduce the time to disposition for the finding.

Which tool can help identify known tactics, techniques, and procedures that a threat group is most likely to use when targeting a financial organization?

• A.The Lockheed Martin Cyber Kill Chain Posture panel within Enterprise Security's Incident Review page
• B.The MITRE ATT&CK Posture panel within Mission Control's Incident Review page
• C.Splunk Threat Intelligence Management
• D.The MITRE ATT&CK matrix's industry heatmap in Splunk Security Essentials

In order to perform a complete data assessment, an engineer's role within Splunk must have which of the following?

• A.Access to applicable indexes.
• B.The capability to edit macros.
• C.The capability to create Correlation Searches.
• D.Access to Knowledge Objects.

In which threat intelligence KV store would a list of malicious domains (FQDNs) be stored?

• A.service_intel
• B.certificate_intel
• C.http_intel
• D.ip_intel

Which Splunk Enterprise Security add-on facilitates the ingestion of Threat Intelligence data?

• A.SA-ThreatIntelligence
• B.ESS-Intel
• C.SA-ESSIntel
• D.TA-ThreatIntel