When investigating, what is the best way to store a newly-found IOC?

The correct answer is C. Click the "Add Artifact" button. Using the "Add Artifact" button ensures that the IOC is stored in a structured and searchable manner within the investigation, facilitating better tracking and analysis.

Investigations and Incident Review

Question

Options

APaste it into Notepad.
BClick the "Add IOC" button.
CClick the "Add Artifact" button.
DAdd it in a text note to the investigation.

How the community answered

(45 responses)

A
2% (1)
B
2% (1)
C
91% (41)
D
4% (2)

Explanation

Using the "Add Artifact" button ensures that the IOC is stored in a structured and searchable manner within the investigation, facilitating better tracking and analysis.

Topics

#IOC management#investigation artifacts#incident response#threat indicators

Community Discussion

No community discussion yet for this question.

Full SPLK-3001 Practice