SPLK-5002 · Question #78
An engineer needs to create a new report capturing the vendors and products that detect a particular CVE in their environment. How can they ensure that their search associated with the report only…
The correct answer is B. Search for the cve within the Vulnerabilities data model, using | tstats grouped by vendor_product. To ensure the report only includes accelerated data, the engineer must query the Vulnerabilities data model with | tstats and specify summariesonly=true. This restricts the search to use only accelerated summaries. Grouping by vendor_product with the CVE field provides the…
Question
An engineer needs to create a new report capturing the vendors and products that detect a particular CVE in their environment. How can they ensure that their search associated with the report only includes accelerated data?
Options
- ASearch for the vendor_product within the Vulnerabilities data model, using the | tstats command.
- BSearch for the cve within the Vulnerabilities data model, using | tstats grouped by vendor_product
- CSearch for the vendor_product within the Updates data model, using the | tstats command.
- DSearch for the vendor_product within the Updates data model, using | tstats grouped by eve with
How the community answered
(36 responses)- A8% (3)
- B75% (27)
- C14% (5)
- D3% (1)
Explanation
To ensure the report only includes accelerated data, the engineer must query the Vulnerabilities data model with | tstats and specify summariesonly=true. This restricts the search to use only accelerated summaries. Grouping by vendor_product with the CVE field provides the required breakdown for the report.
Topics
Community Discussion
No community discussion yet for this question.