SPLK-5002 Sample Questions Answers

For a conventional correlation search that creates findings outside the Risk data model, the MITRE ATT & CK technique must be represented through the detection ' s annotation metadata so that downstream Enterprise Security interfaces such as Incident Review can retain and display the technique context.

T1059 corresponds to the MITRE ATT & CK technique family Command and Scripting Interpreter . Assigning the technique to the appropriate MITRE ATT & CK annotation establishes structured metadata rather than simply placing the string T1059 into an arbitrary result field.

This distinction is important because detection annotations support consistent categorization, ATT & CK coverage reporting, analyst interpretation, and security-content management. An arbitrary field containing T1059 does not automatically carry the same semantic meaning. Likewise, a risk-model-specific representation is inappropriate when the question explicitly states that the correlation search does not use the Risk data model.

The supplied material presents this as an SPL/annotation implementation question on page 1.

Study Guide topics: Correlation searches, MITRE ATT & CK annotations, Incident Review, security-content metadata, event-based detections versus risk-based detections.

The SPL is measuring Mean Time to Triage because it calculates the elapsed time between creation of a notable event and the earliest recorded triage-related update.

The most important portion is:

| stats earliest(_time) as create_time, min(time) as triage_time by rule_id

| eval diff=triage_time-create_time

create_time represents when the notable was first generated, while triage_time is derived from the earliest applicable incident update. Subtracting the creation timestamp from the triage timestamp produces the amount of time analysts required to begin processing or triaging the finding.

The search then categorizes records into past and current periods, calculates average differences, and converts those values into minutes. This permits comparison of SOC triage performance across reporting periods.

Mean Time to Respond would require a timestamp representing a response action. Mean Time to Resolve requires closure or resolution information. Dwell Time measures how long adversary activity remains present or undetected and is therefore conceptually different from the notable-event lifecycle calculation shown.

Study Guide topics: SOC metrics, Mean Time to Triage, Incident Management data model, notable lifecycle, incident_updates_lookup, operational performance reporting.

Global field mappings provide a consistent mapping layer when data is exported from Enterprise Security data models or saved searches into Splunk SOAR. The objective is to ensure that semantically equivalent values are represented consistently regardless of which detection, search, or data model produced the source event.

This becomes important when SOAR receives security events from multiple searches. One source might expose an endpoint as dest, another as host, and another might use a product-specific field. Consistent global mapping allows downstream SOAR workflows to operate on standardized field semantics instead of requiring every playbook to understand every upstream schema variation.

A field alias is a Splunk knowledge object that can make one indexed or extracted field available under another name during search processing, but that is not the cross-export mapping mechanism requested here. “Field labels” likewise do not establish the global ES-to-SOAR translation layer. The important clue is the requirement for consistency across both data-model and saved-search exports , which implies a centrally applied mapping configuration.

This design reduces duplicated transformation logic and improves the portability and reliability of automated response workflows.

Study Guide topics: Global field mappings, Enterprise Security-to-SOAR integration, data normalization, event export, automation data consistency.

The appropriate HTTP method is POST . A contextualization playbook submitting a URL to a sandbox is creating a new analysis request and transmitting data to an application endpoint for processing. REST APIs conventionally use POST for this type of operation.

A typical workflow sends an HTTP request containing the URL or artifact information in the request body. The sandbox accepts the submission, generates an analysis job or task identifier, processes the object, and later returns a verdict or detailed analysis. SOAR can subsequently poll for completion or retrieve the resulting disposition.

GET is conventionally used to retrieve an existing resource and normally should not be used to create an analysis job. PUT is generally associated with creating or replacing a resource at a known URI and is not the standard semantic operation for submitting a new sandbox-analysis request. STOR is associated with FTP rather than HTTP and therefore is not an HTTP method applicable to this workflow.

Understanding these API semantics is essential when troubleshooting SOAR integrations because incorrect HTTP methods can produce errors such as 405 Method Not Allowed or other integration failures.

Study Guide topics: SOAR contextualization, REST APIs, HTTP POST, sandbox integration, automated enrichment, artifact analysis.

The required combination must satisfy two independent requirements : restrict the dataset to failed Azure Active Directory authentication activity and represent the origin of those events geographically. Option D provides that combination by selecting the failure-oriented Azure AD sign-in data and using geographic-coordinate information with a Cluster Map .

A geographic cluster visualization is appropriate when individual events contain point locations such as latitude and longitude. Multiple sign-in failures originating from the same geographic area can then be grouped visually, making concentrations outside the expected operating region—here, North America—immediately apparent. This is particularly useful for authentication monitoring because a raw table of IP addresses does not provide the same rapid geographic interpretation.

The search must also distinguish failures from successful authentication. Merely plotting all sign-ins would allow large quantities of legitimate activity to obscure the specific anomalous behavior being investigated. Conversely, choosing an inappropriate geographic visualization for point-coordinate data would not provide the intended presentation.

Study Guide topics: Azure AD authentication data, failed-login filtering, geospatial enrichment, geographic dashboards, Cluster Map visualization, security analytics.

Splunk dashboards use tokens to capture and pass contextual values between dashboard elements, user interactions, and drilldown destinations. Therefore, tokens are the mechanism an engineer can use when a user selects a visualization element and the resulting value must be inserted into another search.

A token can represent contextual information derived from an interaction—for example, a selected host, username, source IP, destination, process, or time range. A drilldown can then use that value to construct a more focused search. Conceptually, a dashboard could capture a selected src value and pass it to a destination search so the analyst moves directly from an aggregate visualization to events associated with that source.

This design improves investigation efficiency because the analyst does not need to manually copy values from one interface into another search. It also preserves analytical context as the user moves from summary information to detailed evidence.

Aliases concern alternate representations of fields; environment variables are not the standard dashboard mechanism for passing selected visualization context; and JSON may define dashboard structures but is not itself the contextual-value mechanism being tested.

Study Guide topics: dashboard tokens, drilldowns, contextual searches, analyst workflow, dashboard interactivity, investigation efficiency.

The Enterprise Security threat-intelligence lookup associated with file-based intelligence is file_intel .

Splunk Enterprise Security organizes threat-intelligence indicators according to observable type. This allows the Threat Intelligence Framework to normalize and match compatible indicators against event telemetry. File-oriented intelligence can contain characteristics such as file hashes, file names, or other file-related observables used to identify known malicious artifacts.

The naming convention is important. file_hash describes a type of file indicator but is not the threat-intelligence lookup name requested by the question. user_intel and user_hash concern user-oriented naming and do not correspond to the file intelligence collection.

The supplied study material demonstrates the same Threat Intelligence Framework design by asking which intelligence KV store contains malicious FQDNs, reinforcing that ES separates intelligence into purpose-specific collections such as service_intel. The exact file_intel question is not shown verbatim in the uploaded 60-question set, but the collection naming and threat-intelligence architecture are consistent with the framework tested there.

Study Guide topics: Threat Intelligence Framework, file_intel, file indicators, IOC normalization, threat matching, KV Store intelligence collections.

A potential detection based on known historical organizational events should be validated by running its SPL across the specific historical interval in which those events occurred. In Splunk, this is accomplished by supplying appropriate earliest and latest time constraints .

This technique allows the engineer to answer a fundamental detection-development question: if the analytic had existed at the time of the known activity, would it have returned the expected events? The engineer can compare the resulting fields, entities, counts, and event relationships with the historical evidence and tune the detection accordingly.

Testing only against the present production interval can produce a false negative simply because the relevant behavior is no longer occurring. Attack Range and Atomic Red Team are valuable for controlled detection testing, but they do not answer the question posed here, which specifically concerns historical events within the organization .

Historical validation also helps establish an initial understanding of expected result volume and potential false-positive conditions before deployment. Once confirmed, additional controlled testing can complement the historical test.

Study Guide topics: detection validation, historical search, earliest, latest, detection testing, SPL time constraints.

The relationship shown in the question is produced through the interaction of the Threat Intelligence Framework and the Risk Framework . Threat intelligence provides known or suspected malicious indicators—such as IP addresses, domains, URLs, file hashes, or other observable objects—that can be matched against security telemetry.

When activity involving those indicators is detected, Enterprise Security can associate that activity with a risk object , such as a user or system, and accumulate risk through the Risk Framework. Rather than immediately treating every individual match as a standalone high-severity incident, risk-based analytics can combine multiple pieces of evidence and build a more meaningful representation of potentially compromised entities.

The screenshot on page 2 displays the Risk Events context, reinforcing that the entities are being represented in terms of accumulated security risk rather than merely listed as asset inventory records. The Assets and Identities framework can enrich entities with contextual information, but the central association described by the question is threat-intelligence evidence being transformed into risk against relevant objects.

This relationship supports higher-confidence detection by combining indicator evidence with entity-centric risk aggregation.

Study Guide topics: Threat Intelligence Framework, Risk Framework, risk objects, threat matching, risk events, risk-based analytics.

The correct component is SA-ThreatIntelligence . Within Splunk Enterprise Security, this supporting add-on is associated with the threat-intelligence framework and the processing of threat indicators used for matching, enrichment, and security analytics.

Threat intelligence may contain observables such as malicious IP addresses, domains, URLs, email indicators, certificate information, file hashes, or other intelligence objects. The framework must normalize and process these indicators so that Enterprise Security searches can compare them with telemetry observed in the environment.

The SA- prefix is significant in the Splunk application ecosystem because supporting add-ons frequently provide underlying searches, knowledge objects, configurations, or framework functionality that other Splunk applications consume. The other names shown in the question are distractors and are not the designated Enterprise Security supporting add-on requested.

Threat intelligence ingestion is more than simply indexing a feed. The resulting indicators must be structured into appropriate collections and made usable by matching processes so that detections can identify interactions between internal activity and known threat objects.

Question 9 is displayed on page 3 of the supplied certification material.

Study Guide topics: SA-ThreatIntelligence, Threat Intelligence Framework, indicator ingestion, threat matching, intelligence normalization, Enterprise Security architecture.

The preferred approach is tstats , because tstats operates against indexed metadata rather than requiring Splunk to retrieve and process every matching raw event. A conceptual implementation is:

| tstats values(sourcetype) WHERE index=* BY index

This produces one result per visible index and lists the sourcetypes associated with each index. It is significantly more efficient than executing:

index=* | stats ...

because the latter can require broad raw-event retrieval across every searchable index. In a large security deployment containing billions of events, that difference is operationally significant.

The tstats command is particularly useful when the required information can be derived from indexed fields or accelerated data structures. Here, both index and sourcetype information can be obtained without inspecting full _raw event payloads.

The phrase " most efficient " is therefore central to the question. Several approaches may theoretically obtain similar information, but a broad raw-event search is unnecessarily expensive when indexed metadata already contains what is required.

This question appears on page 2 of the supplied material.

Study Guide topics: SPL efficiency, tstats, indexed metadata, index discovery, sourcetype inventory, search optimization.

Enterprise Security determines notable-event urgency by combining the severity associated with the finding with the priority of the affected asset or identity . This produces a more context-aware prioritization model than simply treating every detection result with the same severity as equally important.

For example, identical suspicious behavior occurring on an ordinary workstation and on a critical production server may warrant different analyst priorities. Asset and identity enrichment supplies organizational context, while the detection contributes the severity of the observed security condition. Enterprise Security uses those dimensions to derive urgency so analysts can focus first on events with the greatest operational importance.

Option A incorrectly mixes detection execution frequency with risk scoring. Scheduling priority in B controls search execution considerations rather than analyst-facing notable urgency. Option C describes risk accumulation concepts but is not the default notable-event urgency calculation.

The supplied study material reinforces this architecture through its questions on asset priority , Assets & Identities enrichment, critical-asset prioritization, and Enterprise Security risk handling.

Study Guide topics: notable urgency, severity, asset priority, identity priority, Assets & Identities Framework, finding prioritization.

A Risk Factor provides a scalable method for increasing the significance of risk associated with critical entities without creating separate detections for every asset tier. Therefore, the appropriate approach is to establish a general risk rule for authentication activity and apply an increased Risk Factor when the affected asset meets critical-asset criteria.

Risk-Based Alerting separates individual security observations from the final analyst-facing finding. Multiple low- or medium-confidence events can contribute risk to an entity, while contextual factors modify their importance. A critical production server, domain controller, or other highly sensitive asset can therefore receive greater effective risk than an ordinary workstation when otherwise equivalent activity occurs.

This directly addresses the requirement to prioritize critical assets without substantially increasing finding volume . Creating separate findings for every authentication event would overwhelm analysts. Instead, risk events can accumulate until meaningful combinations or thresholds justify escalation.

Changing every existing detection individually is less maintainable, while simply adding assets to a data model does not implement the required prioritization logic. Risk Factors provide contextual multiplication of risk based on entity characteristics.

Study Guide topics: Risk-Based Alerting, Risk Factors, asset criticality, risk objects, finding reduction, contextual prioritization.

Using the third-party product ' s REST API with Splunk SOAR is the most efficient approach because SOAR is designed to orchestrate external security technologies programmatically. A REST integration allows SOAR to retrieve vulnerability information, enrich assets, initiate remediation actions, track execution status, and incorporate those operations into repeatable playbooks.

A typical workflow could use API requests to obtain vulnerability findings, identify the affected asset, determine severity, invoke a remediation or ticketing action, and subsequently verify completion. The uploaded course material emphasizes REST communication, SOAR assets, HTTP methods, authentication, and automated playbook actions as core integration concepts.

Manual alerts do not accomplish automation. Creating a separate correlation search for every vulnerability type creates unnecessary detection-management overhead and does not provide the remediation integration itself. Dashboards improve visibility but remain observational rather than actionable.

The REST approach also separates concerns appropriately: the vulnerability platform remains the source of vulnerability-management capability, while SOAR coordinates the workflow through authenticated API calls and automation logic.

Study Guide topics: Splunk SOAR, REST APIs, third-party integrations, playbooks, automated remediation, API authentication, orchestration.

The Enterprise Security Risk Framework enables detection engineers to express suspicious observations as risk against meaningful entities—typically users, systems, or other risk objects—and then prioritize those observations according to their security significance. Option C therefore represents the principal value being tested: prioritizing findings based on potential business impact .

In a Risk-Based Alerting design, an individual behavior does not necessarily need to generate an analyst-facing finding immediately. Instead, detections can generate risk events containing fields such as the risk object, risk object type, risk score, and contextual annotations. Multiple risk events can accumulate until correlation logic determines that the combined evidence warrants escalation. Risk Factors and asset/identity context can further modify significance when an affected entity is particularly sensitive or critical.

Risk processing is therefore fundamentally about contextual prioritization and evidence aggregation , not search-performance acceleration. It does not inherently create a threat-intelligence feedback loop, nor is its primary purpose to simplify SOAR execution. Those capabilities can interact with risk-based detections but are separate functions.

Study Guide topics: Enterprise Security Risk Framework; Risk-Based Alerting; risk objects; risk scores; business impact; security finding prioritization.

The key-value pairs appearing after the ? character in a URL are parameters , more specifically query parameters . The example structure shown in the supplied material follows the standard pattern:

?type=hash & data= < value >

Here, type=hash and data= < value > are query parameters. The question mark marks the beginning of the URL ' s query component, while an ampersand ( & ) separates multiple parameter pairs. Each parameter typically consists of a key followed by = and its corresponding value.

This must be distinguished from an HTTP payload , which is normally transmitted in the request body, particularly with operations such as POST or PUT. Headers are separate HTTP metadata elements containing information such as authorization credentials, content type, accepted response formats, and user-agent information. “KV Elements” is not the HTTP/REST terminology for the URL query component.

Understanding this distinction is important when configuring SOAR integrations because an API may require values in different locations. Supplying a required query parameter in the request body—or vice versa—can result in validation failures even when the correct data is present.

Study Guide topics: REST APIs; query parameters; HTTP requests; SOAR integrations; URL structure; API troubleshooting.

A drill-down search is specifically designed to give analysts additional investigative context directly from a detection or finding. It allows an engineer to define a follow-on search that pivots from the current result into relevant supporting telemetry using fields such as user, src, dest, process name, host, or other contextual attributes.

For example, a finding concerning a suspicious user could provide a drill-down that automatically searches recent authentication activity for that same user. This reduces manual copying of values and significantly accelerates triage. The study material reinforces this workflow through its coverage of contextual dashboard values and drilldowns, where tokens can pass selected information into a new search.

A Correlation Search Name identifies the analytic but does not provide investigative context. A Risk Object Name identifies the entity receiving risk but does not define a contextual pivot. The Risk Analysis Adaptive Response Action creates or contributes risk events; it does not itself provide the analyst-facing navigation mechanism described.

Study Guide topics: drilldown searches, analyst triage, contextual fields, correlation searches, investigation workflow, detection actionability.

Correlation search throttling is specifically intended to suppress repeated results that represent the same or substantially equivalent detection condition within a defined period. It is therefore the appropriate setting when a correlation search generates multiple findings for what analysts consider one potential incident.

Throttling is generally based on one or more result fields and a suppression period. For example, if repeated executions identify the same user and dest, the search can suppress additional findings matching that combination during the configured interval. This reduces redundant analyst workload while allowing materially different entities or events to generate new findings.

The engineering requirement is to select throttling fields carefully. Overly broad suppression can conceal genuinely distinct security events, while overly narrow suppression may fail to reduce duplicate findings. The suppression period likewise should reflect the behavior being detected and the expected recurrence pattern.

Correlation search priority affects prioritization rather than duplication. An adaptive risk modifier adds or modifies risk-related information but does not directly solve repeated notable generation. Adaptive response actions control downstream outcomes rather than the duplicate-suppression behavior requested.

Study Guide topics: correlation-search throttling, duplicate findings, notable suppression, detection tuning, analyst workload, false-positive reduction.

An HTTP 403 Forbidden response indicates that the server understood the request but refuses to authorize the requested operation. In a SOAR asset integration, this strongly points to an authorization or permissions problem involving the credentials configured for that asset. Therefore, asset credentials lacking adequate permissions is the appropriate answer.

This should be distinguished from authentication failures. Incorrect credentials commonly result in an HTTP 401 Unauthorized response, while a nonexistent REST resource more commonly produces 404 Not Found . A requirement for a different authentication mechanism, such as an API token, can ultimately cause authentication problems, but the question specifically associates the observed response with permissions.

For SOAR integrations, the service account should have the minimum privileges required for the actions performed by playbooks. For example, a read-only account may successfully retrieve endpoint information but receive 403 when a playbook attempts an administrative operation such as quarantining a host or blocking an indicator.

Study Guide topics: SOAR assets, REST APIs, HTTP status codes, authentication versus authorization, integration troubleshooting, least privilege.

The affected metrics are Mean Time to Respond and Mean Time to Resolve because both can depend on the expected lifecycle of a notable beginning in the default New state and progressing through subsequent analyst-handling states.

If Testing is accidentally configured as the default, newly generated notables no longer begin with the status value expected by searches or reports that identify sequences such as:

New → In Progress

or

New → ... → Resolved

As a result, the timestamp used to establish the beginning of the response or resolution interval may be missing from the expected status-change sequence, producing inaccurate, incomplete, or excluded metric calculations.

Dwell Time is different. It measures how long malicious activity remains present or undetected in the environment and is not fundamentally calculated from Enterprise Security notable-status transitions. That eliminates options C and D. Option B is also incorrect because changing a status value relied upon by existing SOC metric searches can directly alter their results.

The supplied guide explicitly emphasizes notable status and ownership as operational SOC measurement fields , supporting the importance of preserving lifecycle-state consistency.

Study Guide topics: notable-event lifecycle, status transitions, Mean Time to Respond, Mean Time to Resolve, SOC metrics, reporting consistency.

EventCode 4104 represents PowerShell Script Block Logging , making it the relevant telemetry for inspecting PowerShell code executed in an environment. The question specifically ties the detection requirement to PowerShell Script Block Logging and therefore directly points to 4104.

Script Block Logging provides visibility into PowerShell script content after PowerShell has processed the command or script block. From a detection-engineering perspective, this can expose suspicious commands, modules, functions, credential-access behavior, encoded or obfuscated PowerShell content, and scripts associated with offensive frameworks. An engineer can search this telemetry for characteristics associated with the behavior discovered during the red-team exercise and subsequently operationalize reliable indicators into a detection.

EventCode 4624 , by comparison, represents a successful Windows logon and can be useful in authentication and lateral-movement analysis, but it is not the PowerShell Script Block Logging event explicitly requested. The remaining distractor event codes do not represent the logging mechanism identified in the question.

The distinction matters because endpoint detections depend on selecting telemetry that observes the relevant layer of attacker behavior. Here, PowerShell execution content—not merely authentication—is the required visibility source.

Study Guide topics: PowerShell logging, EventCode 4104, endpoint telemetry, behavioral detection, red-team findings, Windows security monitoring.

An Endpoint Detection and Response (EDR) product operates primarily on endpoint processes, files, devices, and endpoint-derived indicators. Accordingly, the actions most naturally associated with an EDR integration are block hash, block process, quarantine device, and get indicator .

Blocking a file hash prevents a known malicious executable from running or being accepted by the endpoint control plane. Blocking or terminating a process directly addresses active execution. Quarantining or isolating a device provides containment by restricting network communication while allowing security personnel to continue investigation. Retrieving indicators allows the SOAR workflow to enrich subsequent decisions using endpoint telemetry.

The other choices combine actions normally owned by different security controls. Removing an email generally belongs to an email-security platform; detonating a URL is normally performed by a sandbox or analysis service; blocking domains or subdomains typically involves DNS, proxy, or network-security technology; and resetting a password is usually performed through an identity provider or directory service.

A well-designed Splunk SOAR playbook therefore maps actions to the capabilities of the integrated asset rather than assuming every security control can perform every response operation.

Study Guide topics: Splunk SOAR assets, EDR integrations, endpoint containment, playbook actions, orchestration, response-tool capability mapping.

An Input playbook is the appropriate playbook type when the workflow must be invoked directly from Splunk Mission Control or Enterprise Security. Input playbooks are designed with an externally supplied input interface so that another Splunk security product can provide the data required by the playbook at invocation time.

This distinction matters because externally initiated playbooks need a defined contract describing what values the calling system passes into the workflow. Mission Control or Enterprise Security may provide information associated with the finding, event, entity, indicator, or investigation. The Input playbook can then use those supplied values for enrichment, investigation, containment, or other automated actions.

A generic Automation playbook is focused on orchestration logic but does not represent the specific external invocation model being tested. “Process” and “Response” are distractors in this context and do not identify the required playbook type.

Architecturally, Input playbooks help decouple the upstream detection platform from SOAR implementation details: Enterprise Security identifies the security condition and passes structured information, while SOAR executes the automated workflow.

Study Guide topics: Splunk SOAR playbook types; Input playbooks; Mission Control integration; Enterprise Security integration; external playbook invocation.

The tag or tags assigned to an event type establish its semantic association with the appropriate Common Information Model data-model dataset. Splunk CIM commonly uses event types together with tags to classify heterogeneous events into standardized categories.

An event type itself is defined by a search expression that identifies matching events, but the search string does not by itself establish CIM data-model membership. After the event type has been created, the appropriate CIM tag—such as one representing authentication, network traffic, change activity, or another normalized domain—is applied. Data-model dataset constraints can then recognize events carrying the required tag.

Field aliases serve a different purpose: they map source-specific field names to normalized CIM field names. They are essential for schema normalization but do not determine the event type ' s association with a data model. Similarly, a saved-search name has no role in assigning CIM dataset membership.

The supplied Cybersecurity Defense Engineer material explicitly tests the same architectural concept by identifying tags as the construct that ensures events from different sources participate in an applicable CIM data model.

Study Guide topics: CIM, event types, tags, data-model constraints, field normalization, CIM dataset membership.

Threat Detection and Incident Response must be evaluated in the context of the organization ' s business model, operating environment, assets, adversaries, and industry-specific threat landscape . Detection engineering cannot be prioritized effectively using technical indicators alone.

For example, credential-access activity affecting an ordinary laboratory workstation and the same activity affecting a privileged financial system may require substantially different priorities. Similarly, a healthcare organization, financial institution, manufacturer, and cloud provider have different critical systems, regulatory requirements, attack surfaces, and likely adversary objectives.

MITRE ATT & CK provides an excellent taxonomy for adversary tactics and techniques, but ATT & CK itself does not define an organization ' s risk appetite . Risk appetite depends on business governance and tolerance for operational, financial, regulatory, and security impact. Therefore, option B improperly substitutes a threat-behavior framework for a business risk-management decision.

Focusing on the least impactful threat vectors is equally inconsistent with risk-based security engineering. Effective programs allocate detection and response resources according to realistic threats and organizational consequences.

The question appears in the lifecycle section on page 3 of the supplied material.

Study Guide topics: Threat Detection and Incident Response lifecycle, business context, risk prioritization, threat modeling, MITRE ATT & CK, program maturity.

The correct REST endpoint is:

| rest /services/alerts/alert_actions

The alert_actions endpoint exposes the alert-action resources available to Splunk, allowing an engineer to enumerate configured actions and inspect associated metadata. In practical administrative searches, the returned results can be further reduced with commands such as:

| rest /services/alerts/alert_actions

| table title, eai:acl.app, label, payload_format, command

Option A references adaptive_response_action, which is not the general endpoint used to enumerate the alert-action collection. Option B points toward correlation-search resources rather than alert actions. Option C is incorrect both because the resource path is malformed (alert actions instead of alert_actions) and because /_acl concerns access-control metadata for a resource rather than listing the alert actions themselves.

The supplied study guide covers related REST/API, adaptive-response, and automation concepts, but it does not show this exact endpoint verbatim.

Study Guide topics: Splunk REST API, | rest, alert actions, Adaptive Response Actions, REST resource paths, administrative inspection.

The most scalable approach is to include the appropriate standard CIM asset and identity fields in the detection results. Enterprise Security can then use its Assets and Identities framework to recognize those normalized entities and apply available contextual enrichment to the resulting risk activity.

Typical CIM-aligned entity fields include values representing users, source systems, destinations, and devices. Correctly populating these fields enables downstream Enterprise Security functionality to associate detection results with known entities and retrieve attributes such as priority, organizational context, category, ownership, or other maintained asset/identity information.

Option B only addresses identity enrichment, while option C addresses only assets. The requirement explicitly concerns both asset and identity context , making either lookup alone incomplete. Option D is also inappropriate because querying Active Directory directly at detection time is not the standard mechanism for applying the complete ES asset-and-identity context and would introduce unnecessary external dependency and latency.

The larger engineering principle is that detections should output normalized semantic fields rather than manually embedding every possible contextual attribute. Centralized enrichment then remains maintainable as asset and identity information changes.

Study Guide topics: Assets and Identities Framework, CIM normalization, risk events, contextual enrichment, entity fields, detection output design.

The defensive tactic set represented in the question is Harden, Detect, Isolate, Deceive, and Evict . These concepts describe defensive objectives that complement the adversary-centered behaviors cataloged through MITRE ATT & CK.

Harden concerns increasing resistance to adversary activity before or during attack execution. Detect focuses on identifying malicious behavior or artifacts. Isolate limits an adversary ' s ability to interact with systems, resources, or other components. Deceive employs defensive deception to influence adversary perception or behavior. Evict addresses removing adversarial presence and associated effects from the defended environment.

This complements ATT & CK conceptually: ATT & CK helps defenders describe what adversaries do, while D3FEND structures defensive countermeasure knowledge. For a detection engineer, the pairing can improve security-program design by connecting observable adversary techniques with candidate defensive approaches rather than viewing detection as an isolated control.

The alternative choices contain terms that are not part of the tactic combination tested in the supplied question, such as Enrich, Define, Exhaust, and Eradicate.

Study Guide topics: MITRE D3FEND, MITRE ATT & CK, defensive tactics, security architecture, detection and response strategy.