SPLK-5002 · Question #77
Which stash event field created by an adaptive response action allows for troubleshooting the correlation search that created the notable event?
The correct answer is A. search_sid. The search_sid field in a stash event is created by an adaptive response action and points back to the search job ID of the correlation search that generated the notable. This allows analysts to troubleshoot by reviewing the exact search execution and results.
Question
Which stash event field created by an adaptive response action allows for troubleshooting the correlation search that created the notable event?
Options
- Asearch_sid
- Bsearch_rid
- Corig_sid
- Dorig_rid
How the community answered
(29 responses)- A83% (24)
- B7% (2)
- C7% (2)
- D3% (1)
Explanation
The search_sid field in a stash event is created by an adaptive response action and points back to the search job ID of the correlation search that generated the notable. This allows analysts to troubleshoot by reviewing the exact search execution and results.
Topics
Community Discussion
No community discussion yet for this question.