Splunk Observability Cloud Certified Metrics User — Question 67

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available.
What event disposition should the analyst assign to the Notable Event?

Answer options

• A. Benign Positive, since there was no evidence that the event actually occurred.
• B. False Negative, since there are no logs to prove the activity actually occurred.
• C. True Positive, since there are no logs to prove that the event did not occur.
• D. Other, since a security engineer needs to ingest the required logs.

Correct answer: D

Explanation

The correct answer is 'Other' because the situation requires a security engineer to gather the necessary logs for a proper investigation. The other options are incorrect; 'Benign Positive' implies the event did not happen, 'False Negative' suggests the activity occurred but lacks evidence, and 'True Positive' incorrectly assumes the event happened without proof.