What framework in Enterprise Security allows engineers to build detections using known malicious IOCs, comparing them to event logs to find suspicious behavior?
A cyber defense engineer plays a role in maintaining a secure SOAR Cloud configuration. Which network security statement is correct about SOAR Cloud?
Which Splunk Enterprise Security add-on facilitates the ingestion of Threat Intelligence data?
Based on the provided screenshot, it ' s discovered that different machines or accounts have been associated with the shown threat objects.
Enterprise Security has identified that these machines and accounts all point back to one owner - Fyodor. Which two frameworks in ES are responsible for programmatically associating this information together?
An engineer receives a report that the “Traffic over time by action” dashboard is not populating. It has been confirmed that the relevant logs are being ingested properly and they are CIM compliant. What other configuration may be missing?
For detections that leverage a CIM data model, which aspect of the configuration is responsible for determining which indexes are being searched?
Which practices strengthen the development of Standard Operating Procedures (SOPs)? (Choose three)
Which field in the risk index is used to describe the activity within a finding?
If a correlation search cannot be run at the configured time, which scheduling option should an engineer use to ensure there are no backfill gaps in data?
MITRE D3FEND is designed to compliment MITRE ' s list of adversarial tactics, techniques, and common knowledge (ATT & CK). Which tactics are associated with MITRE D3FEND in order to detect, deny, and disrupt adversarial efforts?
