Splunk Exam SPLK-5002 Topic 5 Question 2 Discussion

How to Reduce False Positives in Correlation Searches?

High false positives can overwhelm SOC teams, causing alert fatigue and missed real threats. The best solution is to fine-tune suppression rules and refine thresholds.

How Suppression Rules & Threshold Tuning Help: Suppression Rules: Prevent repeated false positives from low-risk recurring events (e.g., normal system scans). Threshold Refinement: Adjust sensitivity to focus on true threats (e.g., changing a login failure alert from 3 to 10 failed attempts).

Example in Splunk ES: Scenario: A correlation search generates too many alerts for failed logins. Fix: SOC analysts refine detection thresholds:

Suppress alerts if failed logins occur within a short timeframe but are followed by a successful login.

Only trigger an alert if failed logins exceed 10 attempts within 5 minutes.

Why Not the Other Options?

A. Increase the frequency of the correlation search -- Increases search load without reducing false positives. C. Disable the correlation search temporarily -- Leads to blind spots in detection. D. Limit the search to a single index -- May exclude critical security logs from detection.

Reference & Learning Resources

Splunk ES Correlation Search Optimization Guide: https://docs.splunk.com/Documentation/ES Reducing False Positives in SOC Workflows: https://splunkbase.splunk.com Fine-Tuning Security Alerts in Splunk: https://www.splunk.com/en_us/blog/security