SPLK-5001 · Question #29
A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated…
The correct answer is A. Least Frequency of Occurrence Analysis. Least Frequency of Occurrence (LFO) Analysis is correct because the hunter is specifically filtering for users who appear infrequently in the dataset - those with fewer than 6 logins - and treating low occurrence count as the anomaly signal worth investigating. The core…
Question
A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail. This is an example of what type of threat-hunting technique?
Options
- ALeast Frequency of Occurrence Analysis
- BCo-Occurrence Analysis
- CTime Series Analysis
- DOutlier Frequency Analysis
How the community answered
(22 responses)- A86% (19)
- B9% (2)
- D5% (1)
Explanation
Least Frequency of Occurrence (LFO) Analysis is correct because the hunter is specifically filtering for users who appear infrequently in the dataset - those with fewer than 6 logins - and treating low occurrence count as the anomaly signal worth investigating. The core mechanic is sorting by frequency and isolating the rare events.
Why the distractors are wrong:
- B. Co-Occurrence Analysis looks at events or entities that appear together (e.g., a user logging in at the same time as a specific process runs) - there's no pairing or correlation of two variables here.
- C. Time Series Analysis examines how activity changes over time (spikes, patterns by hour/day/week) - the hunter here is not analyzing when logins happened, only how many.
- D. Outlier Frequency Analysis is a plausible-sounding distractor, but it's not a standard threat-hunting taxonomy term. LFO is the specific, named technique for hunting based on low frequency.
Memory tip: Think of LFO like a DJ term - "Low Frequency Oscillation." In threat hunting, LFO means you're hunting the low-frequency signals (rare events) that hide in the noise of frequent, normal activity. If someone barely logs in, that rarity is the red flag.
Topics
Community Discussion
No community discussion yet for this question.