SPLK-2003 · Question #12
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?
The correct answer is B. Non-null IP addresses. A filter block with only one condition configured which states: artifact..cef .sourceAddress !-, would permit only non-null IP addresses to pass forward to the next block. The !-operator means "is not null". The other options are not valid because they either include null values
Question
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?
Options
- ANull IP addresses
- BNon-null IP addresses
- CNon-null destinationAddresses
- DNull values
How the community answered
(38 responses)- A3% (1)
- B84% (32)
- C5% (2)
- D8% (3)
Explanation
A filter block with only one condition configured which states: artifact..cef .sourceAddress !-, would permit only non-null IP addresses to pass forward to the next block. The !-operator means "is not null". The other options are not valid because they either include null values or other fields than sourceAddress. See Filter block for more details. A filter block in Splunk SOAR that is configured with the condition artifact..cef.sourceAddress != (assuming the intention was to use "!=" to denote 'not equal to') is designed to allow data that has non-null sourceAddress values to pass through to subsequent blocks. This means that any artifact data within the container that includes a sourceAddress field with a defined value (i.e., an actual IP address) will be permitted to move forward in the playbook. The filter effectively screens out any artifacts that do not have a source address specified, focusing the playbook's actions on those artifacts that contain valid IP address information in the sourceAddress field.
Topics
Community Discussion
No community discussion yet for this question.