Refer to the exhibit. Consider a custom lookup table MalwareIPList. An analyst constructed an analytic query to reference the MalwareIPList lookup table. What is the outcome of the analytic query?

Question

Exhibit

Options

• AThe IP address from permitted traffic with a confidence score of 98 is displayed.
• BThe analyst receives an error because the LookupTableGet function can be used only in display
• CThe value for the LookupTableGet function in the analytic search can be either true or false.
• DThe permitted traffic IP address from the Phishing category is displayed.

• A
  19% (3)
• B
  69% (11)
• C
  6% (1)
• D
  6% (1)

Explanation

The LookupTableGet function is designed to enrich event data by referencing a lookup table. However, it cannot be used directly in analytic queries for filtering data before processing. Instead, it is meant to be applied as a display filter to enhance results after retrieval. In the given query, LookupTableGet(MalwareIPList : Source IP : Confidence) >= 87 is being used in a filter condition, which leads to an error because the function is not valid in this context. It should be applied after the data is retrieved, not as a pre-processing filter.

No community discussion yet for this question.