An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the…

Question

Options

• ABenign Positive, since there was no evidence that the event actually occurred.
• BFalse Negative, since there are no logs to prove the activity actually occurred.
• CTrue Positive, since there are no logs to prove that the event did not occur.
• DOther, since a security engineer needs to ingest the required logs.

• A
  5% (2)
• B
  10% (4)
• C
  20% (8)
• D
  66% (27)

Explanation

Option D is correct because when the required logs and artifacts are unavailable, the analyst has no basis to confirm or deny the event - assigning "Other" acknowledges the investigation is blocked due to a data gap and flags that a security engineer needs to ingest the missing log sources before any meaningful disposition can be made.

A (Benign Positive) is wrong because that disposition means the event did occur but posed no real threat - you cannot conclude the event was benign without evidence. B (False Negative) is not a valid Notable Event disposition in Splunk Enterprise Security; it describes a detection gap (something bad that was missed), not an investigation outcome. C (True Positive) is wrong because it asserts the event genuinely occurred as a threat, which requires supporting evidence you don't have.

Memory tip: Think of "Other" as the "I can't tell yet" bucket - if missing data prevents any verdict (true, false, or benign), the answer is always Other, paired with an action item to fix the visibility gap.

No community discussion yet for this question.