Based on this example image, if it is detected that a member has been added to a security- enabled local group, how many risk events will be created?

The correct answer is D. 2. In the example, there are two risk modifiers configured: one for the system (src) and one for the user. Each modifier creates a separate risk event with a score of 10. Therefore, the detection will generate 2 risk events in total.

Advanced Threat Hunting and Analytics

Question

Exhibit

Options

How the community answered

(39 responses)

A
13% (5)
B
5% (2)
C
3% (1)
D
79% (31)

Explanation

In the example, there are two risk modifiers configured: one for the system (src) and one for the user. Each modifier creates a separate risk event with a score of 10. Therefore, the detection will generate 2 risk events in total.

Topics

#risk event generation#security group detection#risk scoring#correlation search behavior

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice