SPLK-3001 Exam Dumps : Splunk Enterprise Security Certified Admin Exam

Detailed information about identities, such as user names, email addresses, phone numbers, and roles, is stored in the Identity Lookup CSV file in Splunk Enterprise Security. The Identity Lookup CSV file is a lookup file that contains the identity data that is collected and extracted from various data sources, such as Active Directory, LDAP, or custom identity lists. The Identity Lookup CSV file is used to enrich events with identity information and generate notable events based on identity correlation searches. You can view and manage the Identity Lookup CSV file using the Asset and Identity Management page in Splunk Enterprise Security. References =

• Manage assets and identities in Splunk Enterprise Security
• Identity Lookup CSV file

A key feature of a glass table is customization. A glass table is a dashboard that allows you to create dynamic and interactive visualizations of your security data. You can customize a glass table by adding static images and text, the results of ad-hoc searches, and security metrics that show the values of KPIs, service health scores, or notable events. You can also configure the appearance, behavior, and drilldown options of the glass table elements. A glass table is not rigid, but flexible and adaptable to your security needs. A glass table is not designed for interactive investigations, but for high-level monitoring and analysis. A glass table does not store data for later retrieval, but shows real-time data generated by KPIs and services. References =

• Create and manage glass tables in Splunk Enterprise Security
• Add security metrics to a glass table in Splunk Enterprise Security

According to the Splunk Add-on Builder documentation, after managing source types and extracting fields, the key step that comes next in the Add-on Builder is to map to data models. Data models are predefined schemas that provide a common standard for organizing and naming data fields across different data sources. Splunk Enterprise Security uses the Splunk Common Information Model (CIM) to enable cross-source analysis and correlation of security events. The Add-on Builder helps you to map your data fields to the CIM data models, such as Authentication, Change, Endpoint, and others. You can use the Data Model Mapper tool to select the data models that are relevant to your data source and map the fields accordingly. You can also validate the data model mappings and preview the results. See Map to data models for more details.

The other options are not the correct steps that come next in the Add-on Builder. Validate and package is the last step in the Add-on Builder, where you can check the quality and readiness of your add-on and create a package file for distribution. See Validate and package for more details. Configure data collection is the first step in the Add-on Builder, where you can specify the method and parameters for collecting data from your data source. See Configure data collection for more details. Create alert actions is an optional step in the Add-on Builder, where you can build custom alert actions or adaptive response actions for Splunk Enterprise Security. See [Create alert actions] for more details. Therefore, the correct answer is D. Map to data models. References =

• Map to data models
• Validate and package
• Configure data collection
• [Create alert actions]

Splunk Add-on Builder | Splunkbase3

Splunk Add-on Builder | Splunkbase