Splunk Certified Cybersecurity Defense Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SIEM

Security Information and Event Management: a platform that centrally collects, normalizes, retains, and correlates log data from many sources to produce searchable records and alerts.

SOC Tier 1 analyst

The first-line monitoring role that validates incoming notables, dismisses clear false positives, and escalates confirmed or ambiguous alerts to Tier 2 for deeper investigation.

Splunk default fields

Fields populated at index time for every event: host, source, sourcetype, index, _time, _indextime, _raw, and linecount. They exist without any field extraction configuration.

Common Information Model

Splunk's normalized schema of data models, tags, event types, and aliases that maps vendor-specific field names to common names so one search covers many sourcetypes.

Notable event

The alert record written to the notable index when a Splunk ES correlation search fires; it carries rule name, severity, urgency, status, owner, and drill-down context.

Correlation search

A scheduled or real-time Splunk ES search that evaluates a detection logic condition against indexed data and, when conditions are met, generates a notable event.

Sourcetype

A default field identifying the format and origin of data, such as xmlwineventlog or linux_secure. It determines which props.conf and transforms.conf parsing rules Splunk applies.

Mean time to detect

MTTD: the average elapsed time between the earliest relevant event timestamp and the moment detection occurred, used to measure monitoring effectiveness across the SOC.

Risk object

The entity a risk event is attributed to, usually a user or a system. Its accumulated risk score is what gets compared against the risk threshold.

Risk score

A numeric point value attached to a detection's risk event. Scores from multiple detections on the same risk object are summed inside the scoring window.

Risk index

The Splunk ES index that stores individual risk events with risk_object, risk_object_type, risk_score, and rule attribution. It is queried to compute aggregate object risk.

Risk notable

An alert generated when a risk object's summed risk exceeds the threshold. It groups the contributing risk events so the analyst reviews one record instead of many alerts.

Risk threshold

The configured total risk score a risk object must exceed within the scoring window before Splunk ES creates a risk notable for that object.

Threat object

An indicator such as an IP, domain, file hash, or user carried in the threat_object field. Its accumulated score is compared against a separate threat object threshold.

Risk factor

A priority multiplier attached to an asset or identity that scales contributed risk, so detections on business-critical entities reach the alert threshold with fewer contributing events.

Risk object type

A field classifying the risk object as user, system, or other. It drives how Splunk ES aggregates, groups, and displays the accumulated risk score.

Threat hunting hypothesis

A testable statement about attacker behavior expected in the environment, such as a specific technique appearing in telemetry, that a hunt search is designed to confirm or refute.

tstats command

A Splunk command that queries accelerated data model summaries instead of raw events, returning counts and aggregations far faster than a raw search over the same time range.

rare command

A Splunk statistical command returning the least frequent field values in a result set, used in hunting to surface unusual processes, parent-child pairs, or domains.

Baseline

A stored or recomputed profile of normal activity for a host, user, or process over a historical period, against which current activity is compared to identify deviation.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques used to structure hunt hypotheses and to measure which behaviors existing detections actually cover.

streamstats command

A Splunk command that computes running aggregates over ordered events, enabling detection of sequences such as repeated failures followed by a success for the same entity.

Data coverage gap

A sourcetype, host, or log channel that is missing or not ingested, which produces false negatives during hunting because the behavior simply never appears in search results.

Hunt documentation outcome

The recorded result of a hunt: a new detection rule, a tuning or exclusion change, a data onboarding request, or a documented negative finding with the search used.

Incident Review

The Splunk ES console where notables are triaged, assigned, commented on, and moved through status states, with links into contributing events and entity context.

Notable status workflow

The lifecycle states of a notable in Splunk ES: New, In Progress, Pending, Resolved, and Closed. Each transition records owner, urgency, severity, and analyst comments.

Throttling

A correlation search setting that suppresses additional notables for the same field-value combination within a defined time span, reducing duplicate alerts without deleting events.

Sysmon Event ID 1

Process Create: records the image path, command line, parent process, user, and hashes of a newly started process, forming the core endpoint detection data source.

Windows event 4625

A failed logon attempt recorded in the Security log. Repeated 4625 events for one account or source indicate password guessing or brute-force activity.

False positive tuning

Adjusting detection logic by raising thresholds, narrowing windows, or adding lookup-based exclusions so that legitimate activity stops firing while malicious behavior still does.

Machine Learning Toolkit

The Splunk app providing ML commands and algorithms used to build anomaly detections, such as density function or outlier models trained on historical event behaviour.

transaction command

A Splunk command that groups related events sharing a key into a single record using maxspan and maxpause constraints, useful for detecting multi-step attack sequences.