SPLK-5002 · Question #14
A corporate laptop was disconnected from the internet Friday at 5PM local time. While offline, the user unknowingly opened a malicious file. The laptop came back online the following Monday morning…
The correct answer is B. Leverage an event time configuration within the detection. To catch events that occurred while the laptop was offline and only indexed later, the detection should leverage event time rather than index time. Event time ensures detections are based on when the activity actually happened, not when the logs were ingested, preventing missed…
Question
A corporate laptop was disconnected from the internet Friday at 5PM local time. While offline, the user unknowingly opened a malicious file. The laptop came back online the following Monday morning, 9AM local time. The current detection has a 15 minute lookback period. How can the detection be tuned to account for this scenario?
Options
- AIncrease the info_min_time to account for the weekend.
- BLeverage an event time configuration within the detection.
- CLeverage an index time configuration within the detection.
- DIncrease the info_max_time to account for the weekend.
How the community answered
(31 responses)- A3% (1)
- B84% (26)
- C10% (3)
- D3% (1)
Explanation
To catch events that occurred while the laptop was offline and only indexed later, the detection should leverage event time rather than index time. Event time ensures detections are based on when the activity actually happened, not when the logs were ingested, preventing missed findings after delayed ingestion.
Topics
Community Discussion
No community discussion yet for this question.