SPLK-5002 · Question #68
Consider the following series of events: 4:00 GMT Detection runs for interval 3:30-4:00 4:30 GMT Detection runs for interval 4:00-4:30 4:35 GMT Event 1 occurs on an endpoint 4:45 GMT Event 1 is…
The correct answer is B. The logs are delayed so the detection time window needs to be increased. In this scenario, events are indexed after the scheduled detection window has already executed, meaning detections miss relevant events. This happens due to log ingestion delay. The solution is to increase the detection time window (or use a delay offset) so that detections…
Question
Consider the following series of events:
4:00 GMT Detection runs for interval 3:30-4:00 4:30 GMT Detection runs for interval 4:00-4:30 4:35 GMT Event 1 occurs on an endpoint 4:45 GMT Event 1 is indexed 5:00 GMT Detection runs for interval 4:30-5:00 5:05 GMT Event 1 finding is added to ES with timestamp 4:35 5:24 GMT Event 2 occurs on an endpoint 5:30 GMT Detection runs for interval 5:00-5:30 5:35 GMT Event 2 is indexed 6:00 GMT Detection runs for interval 5:30-6:00 What is the problem with the detection schedule chosen and how can it be solved?
Options
- AThe time window for the detection is too large, causing duplicate alerts.
- BThe logs are delayed so the detection time window needs to be increased.
- CThe time window for the detection is too small, causing duplicate alerts.
- DThe logs are delayed so the detection time window needs to be decreased.
How the community answered
(31 responses)- A3% (1)
- B74% (23)
- C6% (2)
- D16% (5)
Explanation
In this scenario, events are indexed after the scheduled detection window has already executed, meaning detections miss relevant events. This happens due to log ingestion delay. The solution is to increase the detection time window (or use a delay offset) so that detections account for delayed logs, ensuring events like Event 1 and Event 2 are included in the proper detection run.
Topics
Community Discussion
No community discussion yet for this question.