Splunk
SPLK-3001 · Question #8
Which of the following actions would not reduce the number of false positives from a correlation search?
The correct answer is A. Reducing the severity. Reducing the severity of a correlation search does not impact the actual number of false positives generated. Instead, it changes how critical those alerts appear but does not affect the underlying logic or frequency of the alerts.
Tuning Correlation Searches
Question
Which of the following actions would not reduce the number of false positives from a correlation search?
Options
- AReducing the severity.
- BRemoving throttling fields.
- CIncreasing the throttling window.
- DIncreasing threshold sensitivity.
How the community answered
(45 responses)- A76% (34)
- B9% (4)
- C13% (6)
- D2% (1)
Explanation
Reducing the severity of a correlation search does not impact the actual number of false positives generated. Instead, it changes how critical those alerts appear but does not affect the underlying logic or frequency of the alerts.
Topics
#false positives#throttling#correlation search tuning#severity
Community Discussion
No community discussion yet for this question.