SPLK-5002 · Question #26
Based on the provided screenshot, it's discovered that different machines or accounts have been associated with the shown threat objects. Enterprise Security has identified that these machines and…
The correct answer is C. Risk, Assets & Identities. The Risk framework aggregates risky behaviors and assigns risk scores to users, systems, or accounts, while the Assets & Identities framework enriches events by correlating them with identity and asset information. Together, they programmatically associate different machines…
Question
Based on the provided screenshot, it's discovered that different machines or accounts have been associated with the shown threat objects. Enterprise Security has identified that these machines and accounts all point back to one owner - Fyodor. Which two frameworks in ES are responsible for programmatically associating this information together?
Exhibit
Options
- AThreat Intelligence, Assets & Identities
- BRisk, Incident Review
- CRisk, Assets & Identities
- DThreat Intelligence, Risk
How the community answered
(31 responses)- A3% (1)
- B6% (2)
- C81% (25)
- D10% (3)
Explanation
The Risk framework aggregates risky behaviors and assigns risk scores to users, systems, or accounts, while the Assets & Identities framework enriches events by correlating them with identity and asset information. Together, they programmatically associate different machines and accounts back to a single owner, as shown with Fyodor in the screenshot.
Topics
Community Discussion
No community discussion yet for this question.