The below search is used to tabulate the Risk Score by Entity. What is incorrect about this search?

The correct answer is C. risk_field should be risk_object. In the Risk data model, the correct field for linking entities is risk_object, not risk_field. Using risk_field is incorrect because it does not represent the entity being scored. The search should aggregate on risk_object to properly tabulate risk scores by entity.

Advanced Threat Hunting and Analytics

Question

Exhibit

Options

Arisk_field should be risk_entity
Bcim_entity_zone should be cim_zone
Crisk_field should be risk_object
Dcim_entity_zone should be entity_zone

How the community answered

(53 responses)

A
11% (6)
B
2% (1)
C
81% (43)
D
6% (3)

Explanation

In the Risk data model, the correct field for linking entities is risk_object, not risk_field. Using risk_field is incorrect because it does not represent the entity being scored. The search should aggregate on risk_object to properly tabulate risk scores by entity.

Topics

#risk-based alerting#risk_object field#SPL syntax#search debugging

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice