Splunk
SPLK-3001 · Question #83
SPLK-3001 Question #83: Real Exam Question with Answer & Explanation
The correct answer is C. Click the "Add Artifact" button.. Using the "Add Artifact" button ensures that the IOC is stored in a structured and searchable manner within the investigation, facilitating better tracking and analysis.
Question
When investigating, what is the best way to store a newly-found IOC?
Options
- APaste it into Notepad.
- BClick the "Add IOC" button.
- CClick the "Add Artifact" button.
- DAdd it in a text note to the investigation.
Explanation
Using the "Add Artifact" button ensures that the IOC is stored in a structured and searchable manner within the investigation, facilitating better tracking and analysis.
Community Discussion
No community discussion yet for this question.