Splunk Certified Cybersecurity Defense Engineer

The threat-hunting team has identified suspicious activity. An analyst manually creates a notable event using an event action to track the activity. How should...

A detection engineer is using a threat defense informed strategy to define use cases. Which Splunk app would best facilitate their use case development process...

What can an engineer use to capture contextual values from a dashboard and create a drilldown to link to a new search?

A corporate laptop was disconnected from the internet Friday at 5PM local time. While offline, the user unknowingly opened a malicious file. The laptop came bac...

Which of the following detections would use a high count of events with Windows Event Code 4740 grouped by a user to determine suspicious behavior?