Exam SPLK-3001 topic 1 question 22 discussion

Answer is C

there are assets and identities in ES - IP address belongs to assets

Definitely asset.

It's C an asset, In Splunk Enterprise Security, an asset typically refers to IP addresses, hostnames, and MAC addresses, which are used to identify and categorize different devices and systems within the network.

Answer is C: Explanation: “10.22.63.159”, “websvr4”, and “00:26:08:18: CF:1D” would be matched against an asset in ES. An asset is a device on a network that can be identified by an IP address, MAC address, DNS name, or other attributes. ES uses an asset and identity system to correlate asset and identity information with events to enrich and provide context to the data1. The asset fields that ES can match include ip, mac, nt_host, dns, and others2. An identity is a user account that can be identified by a username, email address, phone number, or other attributes. An identity is not the same as an asset, although an identity can be associated with an asset1. References = Add asset and identity data to Splunk Enterprise Security Asset and identity fields in Splunk Enterprise Security

C. An asset.

Suggested Answer

C for sure

Answers is C Asset field matching settings – Name - which headers/fields in a lookup table to match during the merge process – Key - like ip (key), field is used in merge process – Tag - field can be used as an asset tag – Multivalue - field can output multiple values – Multivalue Limit - number of values in a multivalue field merge Administering Splunk Enterprise Security page 276

C is correct