Exam SPLK-5001 topic 1 question 11 discussion

Option B. Add this information to the risk_message is indeed a viable and effective choice, especially in the context of Risk-Based Alerting (RBA) in Splunk. By adding key information to the risk_message, you enhance the context around each risk event, allowing the analyst to quickly view relevant details without needing to drill down into raw logs. This approach can streamline investigations by summarizing essential details directly within the notable events, making the process faster and more efficient for the analyst. In this case, both A and B can be good options, but B might offer more immediate context within the Incident Review, especially if the goal is to have critical information surfaced directly in risk events.

Creating a field extraction allows the analyst to easily access and utilize specific data points within the raw logs, making it more efficient to analyze and correlate with the suspicious activity. This will enhance their ability to determine the nature of the activity and its potential maliciousness.

see previous comment

B. Add this information to the risk_message. Explanation: The risk_message field in Splunk's Enterprise Security contains details about why a particular risk event was generated. By asking the engineer to add the relevant information from the raw logs to the risk_message, the analyst can have easy access to important context directly within the risk events, making their analysis more efficient without needing to refer back to the raw logs constantly.