For a conventional correlation search that creates findings outside the Risk data model, the MITRE ATT & CK technique must be represented through the detection ' s annotation metadata so that downstream Enterprise Security interfaces such as Incident Review can retain and display the technique context.
T1059 corresponds to the MITRE ATT & CK technique family Command and Scripting Interpreter .
Assigning the technique to the appropriate MITRE ATT & CK annotation establishes structured metadata rather than simply placing the string T1059 into an arbitrary result field.
This distinction is important because detection annotations support consistent categorization, ATT & CK coverage reporting, analyst interpretation, and security-content management. An arbitrary field containing T1059 does not automatically carry the same semantic meaning. Likewise, a risk-model-specific representation is inappropriate when the question explicitly states that the correlation search does not use the Risk data model.
The supplied material presents this as an SPL/annotation implementation question on page 1.
Study Guide topics: Correlation searches, MITRE ATT & CK annotations, Incident Review, security- content metadata, event-based detections versus risk-based detections.

Why Use Real-Time Notable Event Dashboards for Phishing Detection?
Phishing campaigns require real-time monitoring to detect threats as they emerge and respond quickly.
#Why "Real-Time Notable Event Dashboards" is the Best Choice? (Answer B)#Shows live security alerts for phishing detections.#Enables SOC analysts to take immediate action (e.g., blocking malicious domains, disabling compromised accounts).#Uses correlation searches in Splunk Enterprise Security (ES) to detect phishing indicators.
#Example in Splunk:#Scenario: A company runs a phishing awareness campaign.#Real-time dashboards track:
How many employees clicked on phishing links.
How many users reported phishing emails.
Any suspicious activity (e.g., account takeovers).
Why Not the Other Options?
#A. Weekly incident trend reports - Helpful for analysis but not fast enough for phishing detection.#C. Risk score-based summary reports - Risk scores are useful but not designed for real-time phishing detection.#D.
SLA compliance reports - SLA reports measure performance but don't help actively detect phishing attacks.
References & Learning Resources
#Splunk ES Notable Events & Phishing Detection: https://docs.splunk.com/Documentation/ES#Real-Time Security Monitoring with Splunk: https://splunkbase.splunk.com#SOC Dashboards for Phishing Campaigns:
https://www.splunk.com/en_us/blog/tips-and-tricks

Why Use Data Models in Dashboards?
SplunkData Modelsallow dashboards toretrieve structured, normalized data quickly, improving search performance and accuracy.
#How Data Models Help in Dashboards?(AnswerB)#Standardized Field Naming- Ensures that queries always useconsistent field names(e.g.,src_ipinstead ofsource_ip).#Faster Searches- Data models allow dashboards torun structured searches instead of raw log queries.#Example:ASOC dashboard for user activity monitoringuses a CIM-compliantAuthentication Data Model, ensuring that querieswork across different log sources.
Why Not the Other Options?
#A. To store raw data for compliance purposes- Raw data is stored in indexes,not data models.#C. To compress indexed data- Data modelsstructuredata but donot perform compression.#D. To reduce storage usage on Splunk instances- Data modelshelp with search performance, not storage reduction.
References & Learning Resources
#Splunk Data Models for Dashboard Optimization: https://docs.splunk.com/Documentation/Splunk/latest
/Knowledge/Aboutdatamodels#Building Efficient Dashboards Using Data Models: https://splunkbase.splunk.
com#Using CIM-Compliant Data Models for Security Analytics: https://www.splunk.com/en_us/blog/tips- and-tricks

Splunk prevents duplicate data from being indexed through event parsing, which occurs during the data ingestion process.
How Event Parsing Prevents Duplicate Data:
Splunk's indexer parses incoming data and assigns unique timestamps, metadata, and event IDs to prevent reindexing duplicate logs.
CRC Checks (Cyclic Redundancy Checks) are applied to avoid duplicate event ingestion.
Index-time filtering and transformation rules help detect and drop repeated data before indexing.

The preferred approach is tstats , because tstats operates against indexed metadata rather than requiring Splunk to retrieve and process every matching raw event. A conceptual implementation is:
| tstats values(sourcetype) WHERE index=* BY index
This produces one result per visible index and lists the sourcetypes associated with each index. It is significantly more efficient than executing:
index=* | stats ...
because the latter can require broad raw-event retrieval across every searchable index. In a large security deployment containing billions of events, that difference is operationally significant.
The tstats command is particularly useful when the required information can be derived from indexed fields or accelerated data structures. Here, both index and sourcetype information can be obtained without inspecting full _raw event payloads.
The phrase " most efficient " is therefore central to the question. Several approaches may theoretically obtain similar information, but a broad raw-event search is unnecessarily expensive when indexed metadata already contains what is required.
This question appears on page 2 of the supplied material.
Study Guide topics: SPL efficiency, tstats, indexed metadata, index discovery, sourcetype inventory, search optimization.