Splunk
SPLK-5002 · Question #86
When building detections using the Authentication Data Model, which values are recommended for use against the actions field?
The correct answer is B. success, failure, pending, error. In the Authentication Data Model, the recommended values for the action field are success, failure, pending, and error. These standardized values ensure consistent mapping across authentication data sources for accurate detection and reporting.
Advanced Security Data Onboarding
Question
When building detections using the Authentication Data Model, which values are recommended for use against the actions field?
Options
- Aallowed, blocked, processing, error
- Bsuccess, failure, pending, error
- Csuccess, denied, pending, error
- Dallowed, blocked, teardown, error
How the community answered
(32 responses)- A3% (1)
- B78% (25)
- C13% (4)
- D6% (2)
Explanation
In the Authentication Data Model, the recommended values for the action field are success, failure, pending, and error. These standardized values ensure consistent mapping across authentication data sources for accurate detection and reporting.
Topics
#CIM#Authentication data model#action field values#data normalization
Community Discussion
No community discussion yet for this question.