Free SPLK-5001 Practice Test Questions and Answers (2026) Practice Questions

Splunk Security Essentials is a free application designed to help security practitioners operationalize their data within Splunk. It includes a "Data Source Check" feature that analyzes the data indexed in Splunk, maps it to the Common Information Model (CIM), and highlights which security use cases can be implemented with the available data. This directly addresses the analyst's need to understand which data sources are being utilized and to discover their potential security applications, effectively performing a gap analysis against a library of security content.

A. Splunk ITSI: Splunk IT Service Intelligence (ITSI) is a premium monitoring and analytics solution for IT operations, focused on service health and KPIs, not on security data source analysis for threat detection.

C. SOAR: Splunk SOAR (Security Orchestration, Automation, and Response) is used to automate and orchestrate incident response workflows after a security alert has been generated, not to analyze the completeness of underlying data sources.

D. Splunk Intelligence Management: This platform is used to operationalize threat intelligence from various external sources, rather than analyzing the availability and utility of an organization's internal log data.

---

1. Splunk Security Essentials Documentation: The "Use the Data Source Check" section explicitly details how the app helps users "find out what data you have in Splunk

see how it maps to data models

and learn what security content you can use."

Source: Splunk Documentation

Splunk Security Essentials

"Use the Data Source Check".

2. Splunk Security Essentials Overview: This document describes the application as a starting point for security use cases

helping users "identify the data you need to get into the Splunk platform to make the detections work."

Source: Splunk Documentation

Splunk Security Essentials

"Splunk Security Essentials".

3. Splunk IT Service Intelligence Overview: This documentation clarifies that ITSI is for gaining visibility into the health of critical IT services

which is distinct from security data source analysis.

Source: Splunk Documentation

IT Service Intelligence

"Overview of IT Service Intelligence".

4. Splunk SOAR Overview: The official documentation states that Splunk SOAR "executes security operations actions in seconds" through automated playbooks

confirming its role in response

not data source analysis.

Source: Splunk Documentation

Splunk SOAR (On-premises)

"What is Splunk SOAR?".

Splunk automatically assigns several default metadata fields to each event during the indexing process. These fields include source (the origin of the data, like a file path), host (the hostname of the originating machine), and time (the event timestamp). An "Event description" is not a specific default metadata field. The actual content of the event is stored in the raw field, but "description" is a conceptual term, not an automatically assigned metadata key.

A. Source of data: This is incorrect because source is a fundamental default metadata field that Splunk assigns to identify the origin of the event data.

B. Timestamps: This is incorrect because the timestamp, stored in the time field, is one of the most critical default metadata fields assigned to every event.

C. Host name: This is incorrect because host is a standard default metadata field used to identify the machine from which the event was generated.

1. Splunk Enterprise Documentation

Search Manual

"About default fields": This section explicitly lists the default fields that Splunk software adds to every event it indexes. The list includes host

source

sourcetype

index

and time. The term "Event description" is not mentioned as a default field.

2. Splunk Enterprise Documentation

Getting Data In

"How Splunk software handles your data": This chapter describes the data pipeline. In the "Parsing" phase

it states

"Splunk software examines

analyzes

and transforms the data to extract the default fields

including host

source

sourcetype

and time." This confirms these are default metadata

while "Event description" is not part of this automatic process.

3. Splunk Enterprise Documentation

Knowledge Manager Manual

"About fields": This manual details the different types of fields in Splunk. It distinguishes between default fields added at index time and other fields extracted at search time. The documentation consistently identifies host

source

and time as key default fields

reinforcing that "Event description" is not a recognized default metadata type.

According to the Splunk Common Information Model (CIM) documentation, the srcuser field is designated to represent the user who initiated an action. In the context of a privilege escalation event within the Authentication data model, srcuser captures the identity of the original, less-privileged user. This is distinct from destuser, which would represent the target account with elevated privileges (e.g., 'root' or 'Administrator'). Using srcuser allows security analysts to accurately trace the origin of potentially malicious or unauthorized activity by clearly identifying the actor who performed the action.

A. destuser: This field represents the target user account whose privileges are being assumed, not the user who initiated the action.

B. srcuserid: This field is for a unique identifier (like a SID or UID) of the source user, not the human-readable username.

D. username: While a valid field, the CIM uses the more specific srcuser to clearly distinguish the source actor in events involving interactions between entities.

1. Splunk Documentation. (2024). Common Information Model Add-on Manual

"Authentication". In the section "Fields for the Authentication data model

" the srcuser field is explicitly defined as "The user that initiated the action." This directly corresponds to the user initiating a privilege escalation.

2. Splunk Documentation. (2024). Common Information Model Add-on Manual

"Authentication". The same table of fields defines destuser as "The user that the action was performed on

" which in this scenario is the privileged account

confirming it is not the initiator.

Splunk SOAR (Security Orchestration, Automation, and Response) is designed to automate and orchestrate security workflows. A playbook is a predefined, automated sequence of actions executed in response to a security event. Taking a containment action, such as quarantining a compromised host from the network or disabling a user account, is a classic "Response" use case. This action is a repeatable, procedural task that is perfectly suited for automation within a SOAR playbook to reduce response time and mitigate threats efficiently.

A. Forming hypothesis for Threat Hunting:

Hypothesis formation is a creative and analytical process driven by human security analysts, not a repeatable, automated workflow suitable for a playbook.

B. Visualizing complex datasets:

Data visualization is a core capability of Splunk Enterprise and Splunk Enterprise Security (ES) dashboards, used for analysis and reporting, not a function of Splunk SOAR.

C. Creating persistent field extractions:

This is a data onboarding and knowledge management function performed within Splunk Enterprise or Splunk Cloud Platform to parse data at index time, unrelated to security response.

1. Splunk SOAR Documentation

Use Splunk SOAR

"Automate and orchestrate with playbooks": This section explicitly states

"A playbook is a high-level

code-optional sequence of actions that run against a container to automate the tasks in your security processes." It provides examples of actions such as "quarantining devices

" which directly corresponds to the correct answer.

2. Splunk SOAR Documentation

Splunk SOAR Overview

"What is Splunk SOAR?": This document defines the purpose of the product

highlighting its role in automating "incident response workflows" and "repetitive tasks." Containment actions are a primary example of such tasks.

3. Splunk SOAR Documentation

Use Splunk SOAR

"Example playbook: Automated malware investigation": This document provides a concrete example of a playbook that includes containment steps. It describes a workflow where if a file hash is determined to be malicious

the playbook can "quarantine the device" or "disable the user

" which are containment actions on a compromised host.

The question asks for a framework specifically created to measure cybersecurity maturity. The Cybersecurity Maturity Model Certification (CMMC) is the correct answer, and it is highly probable that "CHMC" is a typographical error for CMMC. The CMMC framework was developed by the United States Department of Defense (DoD) to enforce cybersecurity standards across the Defense Industrial Base (DIB). It is explicitly designed as a maturity model, assessing an organization's implementation of cybersecurity processes and practices across several defined levels, from basic to advanced, thereby measuring their cybersecurity maturity.

A. PCI-DSS: The Payment Card Industry Data Security Standard (PCI-DSS) is a prescriptive set of requirements for securing payment card data, not a framework for measuring organizational cybersecurity maturity levels.

B. GDPR: The General Data Protection Regulation (GDPR) is a legal framework from the European Union focused on data protection and privacy rights for individuals, not a cybersecurity maturity model.

D. FISMA: The Federal Information Security Management Act (FISMA) is a US law requiring federal agencies to implement specific information security programs. It is a compliance framework, not a tiered maturity model.

1. CMMC: U.S. Department of Defense

Office of the Under Secretary of Defense for Acquisition & Sustainment. "CMMC Model Overview." The documentation describes CMMC as a framework to measure the "cybersecurity maturity" of an organization through a series of levels. (Reference: CMMC 2.0 Model documentation available at dodcio.defense.gov/CMMC/).

2. PCI-DSS: PCI Security Standards Council. "PCI Data Security Standard (PCI DSS) v4.0." The official document outlines its purpose as providing "a baseline of technical and operational requirements designed to protect account data." It does not define maturity levels. (Reference: pcisecuritystandards.org

Official PCI DSS documentation

"Introduction" section).

3. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council. "Article 1: Subject-matter and objectives." The regulation's stated objective is the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of such data.

4. FISMA: National Institute of Standards and Technology (NIST). "Federal Information Security Modernization Act (FISMA)." NIST documentation describes FISMA as a framework that requires federal agencies to implement security controls based on risk

focusing on compliance rather than a tiered maturity assessment. (Reference: NIST Special Publication 800-53

Rev. 5

"Security and Privacy Controls for Information Systems and Organizations

" Appendix G).

The Security Engineer is responsible for the implementation, administration, and tuning of security tools and platforms, including the SIEM (like Splunk). When a Security Analyst requires additional data sources to be onboarded or needs correlation rules to be created or modified for better detection, this is a technical implementation task. The request is escalated to the Security Engineer, who has the necessary access, skills, and responsibility to manage the security infrastructure, ingest new data, and develop or refine detection logic. This division of duties allows analysts to focus on monitoring and investigation while engineers focus on maintaining and improving the tools.

A. SOC Manager: This role is responsible for overall SOC strategy, personnel management, and operational oversight, not the hands-on technical implementation of rules or data onboarding.

B. Security Analyst: This is the role that identifies the need and initiates the request; they do not typically have the permissions or responsibility to implement platform-level changes.

D. Security Architect: This role focuses on the high-level design and strategic planning of the security infrastructure, rather than the day-to-day operational tasks of rule creation and data integration.

---

1. Splunk Whitepaper

"Building a Security Operations Center": This document outlines typical SOC roles. It defines the Security Engineer as the role responsible for managing security tools. Their duties explicitly include "maintaining the SIEM

handling data ingestion

and creating new rules for detection." This directly maps to the tasks described in the question. (See page 6

"Key SOC Roles").

2. NIST Special Publication 800-181 Rev. 1

"Workforce Framework for Cybersecurity (NICE Framework)": This standard defines cybersecurity work roles. The Cyber Defense Analyst (AN-TWA-001) "Uses defensive measures and information collected...to identify...events." The Cyber Defense Infrastructure Support Specialist (OM-INF-001) "Tests

implements

deploys

maintains

and administers the infrastructure hardware and software." The analyst's request for more information (data sources

rules) would be fulfilled by the infrastructure support role

which is analogous to a Security Engineer.

3. Splunk Enterprise Security Documentation

"Administer Splunk Enterprise Security": The documentation on creating and modifying correlation searches specifies that a user must have the essadmin role

which has the editcorrelationsearches capability. This administrative role is typically assigned to a Security Engineer or SIEM administrator

not a standard Security Analyst. (See section: "Configure correlation searches in Splunk ES").

The tstats command achieves its high performance by operating directly on indexed metadata, specifically the .tsidx files (also known as the lexicon or time-series index files). This process bypasses the need to access and parse the full raw event data (raw field). In contrast, the stats command typically runs after events have been retrieved from disk and fields have been extracted at search time, which is a significantly more resource-intensive operation, especially across large volumes of data. By querying the pre-structured and optimized index, tstats can return statistical results much more quickly.

A. While tstats is a generating command that runs at the start of a search, its speed is due to what it queries (indexed metadata), not merely its position in the pipeline.

C. A command's syntax, whether it resembles SQL or not, has no direct bearing on its underlying execution performance. The efficiency comes from the data access method.

D. This statement is incorrect and describes the behavior of the stats command. The primary performance benefit of tstats is that it avoids searching raw logs.

1. Splunk Enterprise

Search Manual

Version 9.2.1

"tstats command":

Section: Description: "The tstats command provides a faster alternative to the stats command. It performs statistical queries on indexed fields in tsidx files. The tstats command can be used on normal index data and accelerated data models." This directly confirms that tstats operates on indexed metadata (.tsidx files) for speed.

2. Splunk Enterprise

Knowledge Manager Manual

Version 9.2.1

"Accelerate data models":

Section: How data model acceleration works: "Data model acceleration creates summaries that are separate from the main index... This summarization process is what makes searches that use accelerated data models run so much faster... Splunk Enterprise uses the tstats command to search against the data model summary." This reference explains that tstats is the mechanism for searching the optimized summaries

which are built from indexed data

not raw logs.

3. Splunk Enterprise

Search Reference

Version 9.2.1

"tstats command":

Section: Usage: "Because tstats searches on indexed data

it is not suited for searches on unindexed fields or fields that are extracted at search time." This statement explicitly contrasts tstats with commands that operate on search-time field extractions from raw data

reinforcing why option B is correct and D is incorrect.

The log data reveals millions of identical GET requests originating from a single source IP address (147.186.119.200). This pattern is characteristic of a Denial of Service (DoS) attack, where an attacker attempts to overwhelm a target system's resources (such as CPU, memory, or network bandwidth) with a flood of traffic from a single machine. The goal is to make the service, in this case, the web server, unavailable to legitimate users. The report of the server becoming unavailable confirms the success of this resource-exhaustion attack.

B. A Distributed Denial of Service (DDoS) attack is similar in goal but originates from numerous, geographically dispersed source IP addresses, not a single one as shown in the log.

C. A Cross-Site Scripting (XSS) attack involves injecting malicious scripts into a web page, which would be visible in the URL parameters or request body, not a simple GET /login/ request.

D. A Database Injection attack involves embedding malicious commands (e.g., SQL) in data input fields to manipulate a back-end database; the provided log entry shows no such malicious payload.

1. Splunk Enterprise Security Documentation: The "DoS Attack Detected" correlation search in Splunk Enterprise Security is designed to identify this exact scenario. Its logic detects an abnormally high number of events from a single source (src) to a single destination (dest) within a short time frame

which aligns perfectly with the millions of log entries from one IP.

Source: Splunk Enterprise Security

"Use Splunk Enterprise Security

" Version 7.2.0

Correlation search reference

"DoS Attack Detected".

2. Carnegie Mellon University

Software Engineering Institute (CERT Coordination Center): "A denial-of-service (DoS) attack is an attack meant to shut down a machine or network

making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic or sending it information that triggers a crash. In a DoS attack

a single computer is used to launch the attack." This definition precisely describes the event in the question.

Source: CERT Coordination Center

"Understanding Denial-of-Service Attacks

" Document ID: IN-2001-01.

3. University Courseware (Stanford University): In CS 155

Computer and Network Security

DoS attacks are defined by the "one-to-one" nature of the traffic flood

contrasting with DDoS attacks which are "many-to-one." The log evidence of one IP sending millions of requests is a textbook example of a DoS attack as taught in foundational cybersecurity courses.

Source: CS 155: Computer and Network Security

Lecture 10: "Web Security Model

Network Attacks

" Stanford University.

Mean Time to Respond (MTTR), often referred to as Mean Time to Resolution in Splunk Enterprise Security, measures the average time from when a notable event is created (detection) to when it is closed (remediated). Customizing dashboards to provide analysts with more relevant, contextual information streamlines their investigation and triage workflow. This allows them to understand and act on security events more quickly, directly reducing the time it takes to respond. Therefore, a decrease in MTTR is a primary indicator of improved analyst efficiency resulting from dashboard enhancements.

A. Mean Time to Detect: This metric measures the time it takes for the system to identify and generate an alert, which occurs before an analyst interacts with a dashboard for investigation.

C. Recovery Time: This is a component of the overall response process that focuses specifically on restoring systems to normal operation after containment, not the initial analyst investigation phase.

D. Dwell Time: This measures the duration an adversary is present in a network before being detected. It is a measure of detection capability, not post-detection analyst efficiency.

1. Splunk Enterprise Security Documentation

Use Splunk Enterprise Security

"Security Posture dashboard in Splunk Enterprise Security": The Security Posture dashboard provides Key Performance Indicators (KPIs) to measure the effectiveness of a security program. It includes metrics like "Mean time to triage" and "Mean time to resolution

" which are components of the overall MTTR. The documentation states

"Mean time to resolution is the average time between the creation of a notable event and its closure." This directly measures the full analyst workflow duration that dashboard customization aims to improve.

2. Splunk Enterprise Security Documentation

Administer Splunk Enterprise Security

"Key performance indicators in Splunk Enterprise Security": This section defines the core metrics used to evaluate SOC performance. It explicitly defines "Mean Time to Resolution" as a key metric for tracking the time it takes for analysts to handle notable events from creation to closure

making it the ideal measure for tracking efficiency gains from tooling improvements like dashboard customization.

The metadata command in Splunk is used to return a list of metadata values from a specified index or set of indexes. The type argument determines which kind of metadata is returned. To list the various classifications or "types" of data, the sourcetypes argument is used. A sourcetype in Splunk defines the format and structure of the data, effectively categorizing it. Using | metadata type=sourcetypes will generate a table listing all sourcetypes found within the search's time range and scope, along with associated metadata like event counts and timestamps.

A. metadata type=cdn: cdn is not a valid value for the type argument in the metadata command. The command would return an error.

C. metadata type=assets: assets is not a valid value for the type argument. Asset information in Enterprise Security is managed through asset and identity lookups, not the metadata command.

D. metadata type=hosts: This is a valid argument, but it lists the hostnames (i.e., the machines) that are the source of the data, not the types of data.

---

1. Splunk Enterprise Documentation

Search Reference

"metadata" command.

Section: Syntax

Content: The documentation explicitly lists the valid arguments for the type parameter: type=(hosts | sources | sourcetypes | indexes). This confirms that sourcetypes is the correct option for listing data types and that cdn and assets are invalid. It also distinguishes the purpose of type=hosts from type=sourcetypes.

Reference: Splunk Documentation. (2023). Search Reference: metadata. Retrieved from https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

2. Splunk Enterprise Documentation

Getting Data In

"Why sourcetype matters".

Section: About sourcetypes

Content: This document explains that a sourcetype is one of the most important default fields for searching and categorizing data. It states

"A sourcetype determines how Splunk software formats the data during the indexing process." This establishes "sourcetype" as the correct Splunk terminology for "type of data."

Reference: Splunk Documentation. (2023). Getting Data In: Why sourcetype matters. Retrieved from https://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypematters

The C:\Windows\Temp directory, by default, has permissive Access Control Lists (ACLs) that allow standard users and processes to write files. This makes it a common and convenient location for attackers to use as a staging area. Malware can be downloaded or created in this directory without requiring elevated privileges. Attackers leverage this "world-writable" nature to drop their payloads onto a system and then execute them to establish a foothold or escalate privileges. Monitoring process execution from such temporary locations is a critical security practice.

A. The C:\Windows\Temp directory is owned by the SYSTEM account, and the owner of any executed process is determined by the user context under which it runs, not the file's location.

B. Windows file systems do not typically have a "non-executable" flag for directories like some Linux systems. Execution is governed by file and folder permissions, which usually permit execution from this location.

C. The system page file (pagefile.sys) and other core virtual memory files are located in the root of the system drive (e.g., C:\), not within the C:\Windows\Temp directory.

1. MITRE ATT&CK Framework: The technique T1105

Ingress Tool Transfer

explicitly notes that adversaries may place tools in temporary file locations

such as /tmp/ or C:\Windows\Temp\. This is a well-documented adversary tactic.

Source: MITRE ATT&CK

Technique T1105

"Ingress Tool Transfer". (https://attack.mitre.org/techniques/T1105/)

2. Microsoft Documentation: Official documentation on default permissions confirms that the Users group has permissions to create files and folders within C:\Windows\Temp

making it accessible for staging by low-privilege processes.

Source: Microsoft Docs

"Default permissions for the Temp folder". While a single direct article is elusive

this behavior is described across various Windows Server and Client security guides. For example

see discussions on securing file systems in the Windows Server Security Guide.

3. Splunk Enterprise Security Content Updates (ESCU): Splunk's own security content includes detections specifically for this behavior

validating its significance as an indicator of compromise.

Source: Splunk Enterprise Security Content Update

Analytic: "Executable Launched From Temp Directory". This analytic is designed to detect the exact scenario described in the question

highlighting its importance in the Splunk security context. (e.g.

Analytic found in Splunkbase for ESCU app).

The step-by-step description details a specific implementation of an attack. It names the exact tool used (Cobalt Strike), the specific configuration ("non-default beacon profile"), the delivery method ("unique email...based on extensive research"), and the infrastructure ("compromised website"). This level of specific, operational detail corresponds to the definition of a Procedure within standard cybersecurity frameworks like MITRE ATT&CK. A procedure describes precisely how a specific adversary or piece of malware implements a technique.

A. Tactic: A tactic represents the high-level goal or objective of an attacker, such as 'Initial Access' or 'Command and Control', not the specific steps taken to achieve it.

B. Policy: A policy is a set of guiding principles or rules established by an organization for governance and security, which is irrelevant to an attacker's actions.

D. Technique: A technique is the general method used to achieve a tactical goal (e.g., "Phishing"). The description provided is a specific instance of a technique, making "Procedure" the more precise term.

---

1. MITRE ATT&CK® Documentation: The official ATT&CK documentation defines the relationship between tactics

techniques

and procedures. It states

"Procedures are the specific implementation of a technique or sub-technique by an adversary

" providing examples like the specific malware or tools used. The scenario in the question perfectly aligns with this definition.

Source: MITRE. (n.d.). ATT&CK Basics. MITRE ATT&CK®. Retrieved from https://attack.mitre.org/docs/ATTACKBasics.pdf (Section: "Procedures").

2. Splunk Official Blog: Splunk's own educational materials on the MITRE ATT&CK framework reinforce these definitions. A Splunk blog post clarifies: "Procedures are the specific implementation of a technique. For example

a specific threat group may use a particular phishing email variant to deliver a specific malware payload." This directly mirrors the question's scenario.

Source: Splunk Inc. (2022

August 24). What Is the MITRE ATT&CK Framework?. Splunk.com. (Section: "Tactics

Techniques and Procedures (TTPs)").

3. Carnegie Mellon University

Software Engineering Institute (SEI): Academic and research institutions focused on cybersecurity provide formal definitions. The SEI defines procedures as "the specific steps and tools an actor uses to carry out an attack

" which is precisely what the question describes with Cobalt Strike and a custom beacon.

Source: Prowell

S. J. (2020). A Method for Characterizing Adversary Behavior. Carnegie Mellon University

Software Engineering Institute. CMU/SEI-2020-TR-003

Page 7

Section 2.2.2.

The Security Architect is responsible for the high-level, strategic design of an organization's security infrastructure. This role involves creating the security blueprint, defining requirements, and selecting the core technologies and tools that form the foundation of the security program. They ensure that the security infrastructure effectively supports the duties of other roles, such as the security analyst, by designing an integrated and effective system. Their focus is on the architectural design and technology selection, which directly matches the responsibilities described in the question.

A. Threat Intelligence Analyst: This role focuses on analyzing threat data using existing tools, not on designing the infrastructure or selecting the tools for the organization.

B. SOC Manager: This is a management role responsible for overseeing SOC operations and personnel, rather than the technical design and selection of the underlying security architecture.

C. Security Engineer: This role implements, configures, and maintains the security infrastructure that the architect designs. They are builders and operators, not the primary designers.

1. National Institute of Standards and Technology (NIST). (2020). NICE Cybersecurity Workforce Framework (NIST Special Publication 800-181

Revision 1).

Reference: Work Role ID: SP-ARC-002

Security Architect.

Details: This document defines the Security Architect's tasks

which include: "Designs and develops security architectural artifacts..." and "Determines security design gaps in existing and proposed architectures and recommends changes or enhancements." This explicitly assigns the design and selection responsibility to the architect.

2. Splunk Inc. (2022). The Essential Guide to Security.

Reference: Chapter 2: "Building Your Security Team

" Section on "Key Roles in a Modern Security Team."

Details: This official Splunk guide describes the Security Architect as the role that "designs the organization's security systems

" including selecting appropriate technologies and ensuring they integrate to form a cohesive defense

which security analysts then utilize.

3. Carnegie Mellon University

Software Engineering Institute. (2017). The CERT® Guide to Coordinated Vulnerability Disclosure.

Reference: Section 3.2

"Staffing a Product Security Incident Response Team (PSIRT)."

Details: While focused on PSIRTs

this guide distinguishes between roles. It implicitly places architectural and tool selection decisions at a higher strategic level (architect) than the operational level (analyst) or implementation level (engineer)

reinforcing the standard industry separation of duties.

Mean Time to Respond (MTTR), often used interchangeably with Mean Time to Resolution, is the key performance indicator (KPI) that measures the average time taken to manage an incident from its initial alert to its final closure. In the context of Splunk Enterprise Security, this metric calculates the duration from the createtime of a notable event to its closetime. This precisely matches the scenario of measuring the time between alert creation and the event's closure, even if the resolution is to classify it as a false positive.

B. MTBF (Mean Time Between Failures): This is a reliability metric used to measure the average time between system or component failures, not for tracking incident response lifecycles.

C. MTTA (Mean Time to Acknowledge): This metric measures only the initial part of the response process: the time from alert creation until an analyst formally acknowledges or begins investigating it.

D. MTTD (Mean Time to Detect): This metric measures the time it takes to identify a potential incident before an alert is even created. It covers the period from the actual malicious activity to its discovery.

---

1. Splunk Enterprise Security Documentation

Use Splunk Enterprise Security

"Key performance indicators for the SOC" section.

Reference Detail: This official documentation defines Mean Time to Resolution (MTTR) as "The average time it takes for your team to resolve a security threat." It specifies that the calculation for the duration of a notable event is closetime - createtime

which directly corresponds to the time between alert creation and the close of the event as described in the question.

2. Splunk Enterprise Security Documentation

Administer Splunk Enterprise Security

"Incident Review settings" section.

Reference Detail: This section discusses the configuration of notable event statuses

which are integral to the incident response workflow. The transition of a notable event from "New" to a terminal state like "Closed" is the basis for calculating MTTR. The time spent in this lifecycle is the core of the MTTR metric.

3. Splunk White Paper

The Essential Guide to Security

"Measuring and Communicating Your Security Program" chapter.

Reference Detail: In the section on "Security Operations Metrics

" this guide outlines key metrics for a SOC. It defines MTTR as the time from when an incident is declared (i.e.

an alert is created) to when it is resolved

reinforcing its use for measuring the entire response and resolution phase.

Operational intelligence focuses on the "how" and "why" of an attack. A report detailing a specific threat actor's typical behaviors (their Tactics, Techniques, and Procedures or TTPs) and intent (their motivation and goals) is a classic example of operational CTI. This type of intelligence helps security teams, such as incident responders and threat hunters, understand an adversary's methodology. This enables them to anticipate future attacks and build more resilient and proactive defense strategies against specific, known threats. It provides context beyond simple indicators of compromise.

B. Executive: This is not a standard CTI category; it is typically used as a synonym for Strategic intelligence, which is tailored for a high-level, non-technical audience.

C. Tactical: Tactical intelligence is focused on immediate threats and is highly technical, consisting primarily of specific indicators of compromise (IOCs) like malicious IP addresses, file hashes, or domains for automated blocking.

D. Strategic: Strategic intelligence is high-level, non-technical, and focuses on the broader threat landscape, long-term trends, and potential business impact to inform executive decision-making and risk management.

1. Splunk

"What Is Cyber Threat Intelligence?" Blog

October 26

2022.

Section: The Three Types of Cyber Threat Intelligence. The article defines Operational Intelligence as providing "insights into the 'who

' 'what

' and 'how' of a cyberattack... [it] details the tactics

techniques and procedures (TTPs) of specific threat actors." This directly matches the question's description of a report on a threat actor's behaviors and intent.

2. National Institute of Standards and Technology (NIST)

"NISTIR 8296 (Draft) - Cybersecurity Framework 2.0 Core with Implementation Examples

" February 2024.

Section: ID.RA-P10

Page 31. In the implementation examples for threat intelligence

it describes different levels. The description for understanding "threat actor TTPs

capabilities

and infrastructure" to inform defense aligns with the concept of operational intelligence

which is more detailed than strategic but broader than tactical IOCs.

3. Roberts

S. J.

& Brown

R. (2017). Intelligence-Driven Incident Response: Outwitting the Adversary. O'Reilly Media.

Chapter 2

Section: "Levels of Intelligence." The authors (who are Splunk employees) define operational intelligence as focusing on "details of the operations of a specific adversary

" including their TTPs and infrastructure. This is precisely what the report in the question describes. It contrasts with tactical intelligence

which is defined as focusing on "real-time or near-real-time indicators."