The SOC needs a fast count of failed logons for the treasurer account across last week. Which SIEM search approach is the best practice in Enterprise Security?
Select an answer to reveal the explanation.
Short Explanation
Counting failed treasurer logons with index-star and the word password is searching the landfill with a rake. tstats on an accelerated Authentication model is the SIEM loading dock. Spreadsheets and leading wildcards are how searches miss their shift.
Full Explanation
For a fast count of failed logons for the treasurer account across last week, best practice in Enterprise Security is tstats against an accelerated Authentication data model. tstats reads summarizations, returns quickly at civic scale, and aligns with how ES domain dashboards and correlation content are built. Raw unbounded index-star hunting and spreadsheet exports do not scale for county estates and skip the CIM discipline expected of defense analysts.
Searching index equals star for the word password across every civic index with no time bound fails by performance, noise, and lack of CIM structure. A raw transaction over index star with a leading wildcard is expensive and brittle for weekly failure counts. Exporting every Windows event to CSV to count rows in a spreadsheet abandons SIEM capability and is not Enterprise Security best practice for recurring metrics.
Exam caveat: prefer tstats with accelerated data models for counts and trends; raw unbounded searches are classic wrong answers on SPLK-5001 performance-minded items.
Operational check: run tstats count from datamodel Authentication filtered to the treasurer user and failure action by day over last week, validate a sample against raw events, ensure Authentication acceleration is healthy, and archive the search as a municipal KPI panel if leadership needs the trend.