Splunk
SPLK-5001 · Question #94
In Splunk, what feature would an analyst leverage to drilldown on an IP address field to query third-party intelligence for that IP?
The correct answer is C. Workflow action. Workflow actions let you click on a field value, like an IP address, in search results or dashboards and invoke external lookups or queries (for example, sending the IP to a threat‑intel service) directly from the Splunk UI.
Incident Investigation and Response
Question
In Splunk, what feature would an analyst leverage to drilldown on an IP address field to query third-party intelligence for that IP?
Options
- ANotable drilldown
- BAlert action
- CWorkflow action
- DAdaptive Response action
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C89% (24)
Explanation
Workflow actions let you click on a field value, like an IP address, in search results or dashboards and invoke external lookups or queries (for example, sending the IP to a threat‑intel service) directly from the Splunk UI.
Topics
#workflow actions#threat intelligence#IP lookup#Splunk ES
Community Discussion
No community discussion yet for this question.