Question 51

While working in Mission Control, an analyst is looking to add enrichment and contextualize the finding that is being worked. If they were to click the execute icon next to the
"Mission_Control_Identifier_Reputation_Analysis" playbook, how many playbooks would execute?
  • Question 52

    A threat actor group has begun a campaign that is relevant to an organization. How can the organization's engineer raise the risk score for corresponding intelligence matches in the applicable threat collection?
  • Question 53

    Engineers are commonly asked to turn data sources like EDR alerts into risk events. Doing so requires a dynamic mapping of the signatures in the rule to MITRE ATT&CK. Which of the following fields could be used to dynamically set the MITRE ATT&CK technique ID for the EDR alerts?
  • Question 54

    Which field in the risk index is used to describe the activity within a finding?
  • Question 55

    What is the primary purpose of correlation searches in Splunk?