An engineer is examining a correlation search as a part of a detection review, and sees that it is configured in the following fashion: Which of the following is true about this configuration?

Question

Exhibit

Options

• AThere could be missing data as the search schedule is not ingesting data properly.
• BThere could be missing findings as the search frequency and time range are improperly
• CThe search will run as prescribed without issue every 30 minutes.
• DThe risk modifiers should be adjusted for an hour of data.

• A
  5% (1)
• B
  70% (14)
• C
  5% (1)
• D
  20% (4)

Explanation

The correlation search is scheduled to run every 2 minutes (*/2 * * * *) but is querying a 60-minute window (earliest = -60m@m). This large mismatch between the time range and the execution frequency is considered an improper configuration for ES correlation searches. Such a configuration can lead to inconsistent detection behavior, including missed or duplicate findings, because the search continually reprocesses a very large window using a very short execution interval.

No community discussion yet for this question.