SPLK-5002 · Question #6
An engineer is writing a correlation search and wants to use T1027 from MITRE ATT&CK® as a field in Incident Review. Assuming they are writing a correlation search that does not use the Risk data…
The correct answer is A. | eval annotations.mitre_attack.mitre_technique_id="T1027". To associate a MITRE ATT&CK® technique with a correlation search that does not use the Risk data model, the correct approach is to append an eval statement that sets the annotation field. The correct syntax is | eval annotations.mitre_attack.mitre_technique_id="T1027".
Question
An engineer is writing a correlation search and wants to use T1027 from MITRE ATT&CK® as a field in Incident Review. Assuming they are writing a correlation search that does not use the Risk data model, what example statement should be appended at the end of their correlation search?
Options
- A| eval annotations.mitre_attack.mitre_technique_id="T1027"
- B| set annotations.mitre_attack.mitre_technique_id="T1027"
- C| set field.mitre_attack.mitre_technique_id="T1027"
- D| eval field.mitre_attack.mitre_technique_id="T1027"
How the community answered
(33 responses)- A85% (28)
- B9% (3)
- C3% (1)
- D3% (1)
Explanation
To associate a MITRE ATT&CK® technique with a correlation search that does not use the Risk data model, the correct approach is to append an eval statement that sets the annotation field. The correct syntax is | eval annotations.mitre_attack.mitre_technique_id="T1027".
Topics
Community Discussion
No community discussion yet for this question.