The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

Question

Anirban Ganguly · Accepted Answer

Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

Anirban Ganguly · Answer

Edit the search and modify the notable event status field to make the notable events less urgent.

Anirban Ganguly · Answer

Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

Anirban Ganguly · Answer

Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 54 - SPLK-3001 discussion

Suggested answer: B

0 comments