SPLK-5002 · Question #27
An engineer notices that a detection is creating multiple findings (notables) for the same potential incident. Which setting can be adjusted to reduce the number of generated findings (notables)?
The correct answer is D. Correlation search throttling. Correlation search throttling is used to prevent multiple notable events from being created for the same condition within a defined time window. Adjusting throttling reduces duplicate findings and ensures only meaningful notables are generated.
Question
An engineer notices that a detection is creating multiple findings (notables) for the same potential incident. Which setting can be adjusted to reduce the number of generated findings (notables)?
Options
- ACorrelation search priority
- BAdaptive response actions
- CAdaptive risk modifier
- DCorrelation search throttling
How the community answered
(28 responses)- A4% (1)
- B4% (1)
- C7% (2)
- D86% (24)
Explanation
Correlation search throttling is used to prevent multiple notable events from being created for the same condition within a defined time window. Adjusting throttling reduces duplicate findings and ensures only meaningful notables are generated.
Topics
Community Discussion
No community discussion yet for this question.