Splunk
SPLK-5002 · Question #60
What must be configured as a setting in a correlation search for a notable to be generated?
The correct answer is B. An Adaptive Response Action must be configured to enable the notable generation. In Enterprise Security, correlation searches only create notables when the Create Notable Adaptive Response Action is enabled. This setting defines the notable's title, urgency, and other
Custom Content Development
Question
What must be configured as a setting in a correlation search for a notable to be generated?
Options
- ANothing, the correlation search will generate a notable automatically as an outcome.
- BAn Adaptive Response Action must be configured to enable the notable generation.
- CA SOAR playbook must execute against the notable REST.
- DThe search must end with | notable SPL command.
How the community answered
(33 responses)- A9% (3)
- B82% (27)
- C6% (2)
- D3% (1)
Explanation
In Enterprise Security, correlation searches only create notables when the Create Notable Adaptive Response Action is enabled. This setting defines the notable's title, urgency, and other
Topics
#correlation search#notable events#adaptive response action#ES configuration
Community Discussion
No community discussion yet for this question.