Splunk SPLK-2003 Exam Dumps

Which Phantom API command is used to create a custom list?

• phantom.add_list()
• phantom.create_list()
• phantom.include_list()
• phantom.new_list()

What are the differences between cases and events?

• Case: potential threats. Events: identified as a specific kind of problem and need a structured approach.
• Cases: only include high-level incident artifacts. Events: only include low-level incident artifacts.
• Cases: contain a collection of containers. Events: contain potential threats.
• Cases: incidents with a known violation and a plan for correction. Events: occurrences in the system that may require a response.

Which of the following accurately describes the Files tab on the Investigate page?

• A user can upload the output from a detonate action to the the files tab for further investigation.
• Files tab items and artifacts are the only data sources that can populate active cases.
• Files tab items cannot be added to investigations. Instead, add them to action blocks.
• Phantom memory requirements remain static, regardless of Files tab usage.

When is using decision blocks most useful?

• When selecting one (or zero) possible paths in the playbook.
• When processing different data in parallel.
• When evaluating complex, multi-value results or artifacts.
• When modifying downstream data hi one or more paths in the playbook.

How is it possible to evaluate user prompt results?

• Set action_result.summary. status to required.
• Set the user prompt to reinvoke if it times out.
• Set action_result. summary. response to required.
• Add a decision Mode