Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

Question

Options

• AAdministrative Identities
• BLocal User Intel
• CIdentities
• DPrivileged Accounts

• A
  90% (54)
• B
  7% (4)
• C
  2% (1)
• D
  2% (1)

Explanation

Option A is correct because the Default Account Activity Detected correlation search in Splunk Enterprise Security references the Administrative Identities lookup table, which stores known default account names (e.g., "admin," "administrator," "root") that should not be actively used in a production environment. When activity is detected from one of these entries, the search fires an alert.

Why the distractors are wrong:

• B (Local User Intel) is a threat intelligence lookup for suspicious local users, not a registry of known default accounts.
• C (Identities) is the broad organizational identity asset store used for user enrichment across many searches, but it is not the specific source for flagging default accounts.
• D (Privileged Accounts) tracks accounts with elevated permissions - a related but distinct concept from factory/default accounts.

Memory tip: Think "default accounts need administrative attention" - both words share the idea of built-in, out-of-the-box access, so Administrative Identities is the natural home for tracking them.

No community discussion yet for this question.