A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from…

Question

Options

• ACreate a field extraction for this information.
• BAdd this information to the risk message.
• CCreate another detection for this information.
• DAllowlist more events based on this information.

• A
  74% (43)
• B
  7% (4)
• C
  3% (2)
• D
  16% (9)

Explanation

Option A is correct because field extractions transform raw, unstructured log data into named, searchable fields within Splunk. Once extracted, analysts can easily filter, sort, and correlate that specific information during triage - without manually parsing raw text every time they investigate a Risk Notable.

Why the distractors are wrong:

• B - The risk message is a static text string attached to a risk event. Adding information there makes it readable in one place but not queryable or filterable across many events.
• C - Creating another detection generates more events; it doesn't make the existing event data easier to work with or analyze.
• D - Allowlisting suppresses events based on criteria, which reduces visibility rather than improving the analyst's ability to understand what's happening.

Memory tip: Think of it as "buried treasure" - the useful data is already in the raw log, it just needs to be extracted and labeled so analysts can surface it quickly. Field extractions = making hidden data searchable.

No community discussion yet for this question.