Exam SPLK-5001 topic 1 question 19 discussion

The correct answer is: D. Asset and Identity Framework Explanation: The Asset and Identity Framework is specifically designed to raise the threat profile of individuals (identities) or devices (assets) by correlating events with contextual information. It achieves this by: Enriching raw events with metadata about assets (devices, servers) and identities (users, service accounts). Aggregating suspicious activities tied to specific entities (e.g., repeated failed logins from a user or unusual data transfers from a server). Providing contextual prioritization (e.g., flagging a high-risk activity if it involves a privileged account or a mission-critical server).

Wildcards are not efficient