Tuning Correlation Searches

Question 1

What are adaptive responses triggered by?

Answer 1

By correlation searches and users on the incident review dashboard.

Question 2

What does the summariesonly=true option do for a correlation search?

Answer 2

Searches only accelerated data.

Question 3

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Answer 3

$fieldname$

Question 4

Which of the following is an adaptive action that is configured by default for ES?
- Create notable event
- Create investigation
- Create new correlation search
- Create new asset

Answer 4

Creat notable event

Question 5

Which are the steps to tuning correlation searches?

Answer 5

• Threshold
  
  • The triggering criteria
• Scheduling and throttling
  
  • How often to generate notable events for the same type of incidents
• Adaptive Responses
  
  • Actions to take
• Notable Event Settings
• Risk
  
  • Assigning, increasing or decreasing the risk score for a given type of threat
• Any other adaptive responses

Question 6

Which of the following is part of tuning correlation searches for a new ES installation?
- Configuring correlation result storage
- Configuring correlation notable event index
- Configuring correlation adaptive responses
- Configuring correlation permissions

Answer 6

Configuring correlation adaptive responses.

Question 7

Which of the following actions would not reduce the number of false positives from a correlation search?
- Increasing threshold sensitivity
- Removing throttling fields
- Reducing the severity
- Increasing the throttling window

Answer 7

Reducing the severity

Question 8

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

Answer 8

Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a less common match.

Question 9

Adaptive response action history is stored in which index?

Answer 9

cim_modactions

Question 10

Where is it possible to export content, such as correlation searches?

Answer 10

Configure > Content Management

Question 11

Content Import/Export

Answer 11

• To export any of the content types on the Content Management page, select the object and choose Edit Selected > Export
• Enter an app name, prefix, label, version number, build number and click Export.
• The content will be downloaded as an .spl file. It can then be installed as a new app into another ES search head.
• Import content by installing an app.

Question 12

Which settings indicate that the correlation search will be executed as new events are indexed?
- Continuous
- Real-Time
- Always-On
- Scheduled

Answer 12

Real-Time