C1000-018 試験問題を無料オンラインアクセス

How many normalized timestamp field(s) does an event contain?

• A.3
• B.1
• C.2
• D.4

An analyst needs to create a dashboard item that can be shared with other users. What is the main step in this process?

• A.Enable a new custom dashboard and share it with users.
• B.Have users index the shared search criteria for reuse.
• C.Ask the administrator to modify the shared search criteria and test the dashboard.
• D.Create and share the search criteria that the dashboard Item will use.

An analyst is noticing false positives from a single IP on a specific offense. How can the analyst tune the event rule to eliminate these false positives?

• A.Add the rule test "AND when IP address equals" to the bottom of the test list of the rule.
• B.Add the rule test "AND NOT when the offense is indexed by one of the following IP addresses".
• C.Add the rule test "AND when IP address equals" to the top of the test list of the rule.
• D.Add the rule test "AND NOT when IP address equals" to the bottom of the test list of the rule,

An analyst needs to use a new custom property in a rule.
What must be the mandatory characteristic of the custom property?

• A.It must be stored.
• B.It must be extracted.
• C.It must be boolean.
• D.It must be shared.

What is the intent of the magnitude of an offense?

• A.It measures the importance of the offense.
• B.It measures the importance of the event attached to the offense.
• C.It measures the age of the offense.
• D.It measures the age of the event attached to the offense.