問題文
A correlation search generates an alert with a severity of high. The asset involved has a priority of critical in the asset lookup. In Splunk Enterprise Security's default arrangement, what urgency does the resulting alert carry, and what produced it?
選択肢
- Critical, because the urgency always takes the higher of the two values.
- Unknown, because the asset priority is not part of the urgency calculation until asset and identity correlation is enabled, and nothing can be scored before that runs once.
- Critical, produced by looking up the combination of the severity from the search and the priority from the asset in a lookup that maps the two onto an urgency value.
- High, because the urgency always takes the severity value that the correlation search assigned and the asset priority is used only for sorting the queue, and that means changing the priority in the lookup would not affect the urgency shown on the alert.