nerdexam
Splunk

SPLK-5002 · Question #93

A new playbook needs to be developed for automated phishing analysis and response. Configured in SOAR are integrations with Splunk Enterprise Security and actions from assets that pull in…

The correct answer is A. 1. Ingest the email from the mail vendor. The best workflow for automated phishing analysis and response is: 1. Ingest the email from the mail vendor - acquire the reported email for analysis. 2. Detonate the email in the automated threat analysis system and collect verdict - determine if the email is malicious and…

Security Automation and Orchestration

Question

A new playbook needs to be developed for automated phishing analysis and response. Configured in SOAR are integrations with Splunk Enterprise Security and actions from assets that pull in user-reported emails, perform automated threat analysis, add blocks on the proxy, and an EDR vendor to take various actions. Which would be the best workflow for the new playbook?

Options

  • A
    1. Ingest the email from the mail vendor
  • B
    1. Submit the user reported email from Splunk Enterprise Security
  • C
    1. Submit the email from Splunk Enterprise Security
  • D
    1. Ingest the email from the mail vendor

How the community answered

(24 responses)
  • A
    79% (19)
  • B
    4% (1)
  • C
    13% (3)
  • D
    4% (1)

Explanation

The best workflow for automated phishing analysis and response is: 1. Ingest the email from the mail vendor - acquire the reported email for analysis. 2. Detonate the email in the automated threat analysis system and collect verdict - determine if the email is malicious and extract indicators. 3. Search the mail system for all users that received the email - identify impacted users. 4. Block any malicious URLs and processes with the proxy and EDR solutions - take targeted remediation based on verified malicious indicators.

Topics

#SOAR playbook#phishing analysis#automated response#workflow design

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice