A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Question

Options

• ANull IP addresses
• BNon-null IP addresses
• CNon-null destinationAddresses
• DNull values

• A
  3% (1)
• B
  84% (32)
• C
  5% (2)
• D
  8% (3)

Explanation

A filter block with only one condition configured which states: artifact..cef .sourceAddress !-, would permit only non-null IP addresses to pass forward to the next block. The !-operator means "is not null". The other options are not valid because they either include null values or other fields than sourceAddress. See Filter block for more details. A filter block in Splunk SOAR that is configured with the condition artifact..cef.sourceAddress != (assuming the intention was to use "!=" to denote 'not equal to') is designed to allow data that has non-null sourceAddress values to pass through to subsequent blocks. This means that any artifact data within the container that includes a sourceAddress field with a defined value (i.e., an actual IP address) will be permitted to move forward in the playbook. The filter effectively screens out any artifacts that do not have a source address specified, focusing the playbook's actions on those artifacts that contain valid IP address information in the sourceAddress field.

No community discussion yet for this question.