Splunk SOAR Certified Automation Developer — Question 25

Which of the following describes entities? (Choose all that apply.)

Answer options

• A. Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
• B. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
• C. Multiple entities can share the same alias value, but must have different role values.
• D. To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

Correct answer: D

Explanation

Option D is correct because it directly explains how to restrict KPIs to specific entities based on service. Option A incorrectly states that entities must be IT devices, while B misrepresents the use of abstract entities. Option C is inaccurate since it suggests that sharing alias values is permissible without noting the implications for role differentiation.