Splunk
SPLK-5002 · Question #16
A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an…
Sign in or unlock SPLK-5002 to reveal the answer and full explanation for question #16. The question stem and answer options stay visible for context.
Security Automation and Orchestration
Question
A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?
Options
- AAutomatically send all findings containing the tag "phishing" to create an email notification for the
- BUse a SOAR playbook to submit the email to PhishTank, which will automatically handle the
- CAutomatically assign findings containing the tag "phishing" to analysts to speed up the start of
- DUse a SOAR playbook to handle the Splunk Attack Analyzer submission and data collection
Unlock SPLK-5002 to see the answer
You've previewed enough free SPLK-5002 questions. Unlock SPLK-5002 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#SOAR playbook#phishing automation#Splunk Attack Analyzer#incident response SOP