SPLK-3001 · Question #86
A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are…
The correct answer is C. Modify the correlation schedule and sensitivity for your site. Adjust correlation search sensitivity – False positives: returning results when none are actually there – False negatives: returning no results when something is expected
Question
A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives. What is a solution for this issue?
Options
- ASuppress notable events from that correlation search.
- BDisable acceleration for the correlation search to reduce storage requirements.
- CModify the correlation schedule and sensitivity for your site.
- DChange the correlation search's default status and severity.
How the community answered
(36 responses)- A3% (1)
- B11% (4)
- C83% (30)
- D3% (1)
Explanation
Adjust correlation search sensitivity – False positives: returning results when none are actually there – False negatives: returning no results when something is expected
Topics
Community Discussion
No community discussion yet for this question.