A custom rule is generating events reporting that a specific user is failing to login too many times in the last 5 minutes. The administrator opens the event details to investigate the anomaly…

Question

Options

• Aa Behavioral Detection Rule
• Ban Anomaly Detection Rule
• Ca Threshold Detection Rule
• Da standard Custom Rule

• A
  3% (1)
• B
  84% (26)
• C
  3% (1)
• D
  10% (3)

Explanation

Option B is correct because in most SIEM platforms, the Anomaly details pane is populated only by the platform's native ML/UEBA engine when it scores and classifies a true anomaly. An Anomaly Detection Rule is a custom, manually configured rule that fires based on defined logic - it generates standard detection events but does not attach the ML-scored anomaly metadata required to render the Anomaly details pane. The scenario (counting login failures within a time window) is rule-triggered, not ML-scored, so no pane appears despite the rule type's name.

Why the distractors are wrong:

• A (Behavioral Detection Rule): Behavioral rules flag suspicious endpoint or user behavior patterns; they wouldn't be expected to surface an Anomaly details pane in the first place, making the admin's surprise irrelevant.
• C (Threshold Detection Rule): While the scenario sounds threshold-based (failures within 5 minutes), threshold rules generate standard threshold alerts - not anomaly events - and admins wouldn't specifically expect an Anomaly details pane from them.
• D (Standard Custom Rule): Generic custom rules produce no anomaly-associated metadata at all, and there would be no reason to expect an anomaly pane from a rule that isn't labeled as anomaly-related.

Memory tip: Think of it as a naming trap - an "Anomaly Detection Rule" sounds like it should produce anomaly details, but the pane requires the ML engine, not a custom rule. The rule detects the anomaly; only the ML engine describes it.

No community discussion yet for this question.