A correlation search treats every municipal syslog line as a failed logon because a technical add-on maps the wrong field. Which disposition fits?
Select an answer to reveal the explanation.
Short Explanation
If every syslog burp looks like a failed logon, the analytic is miswired—not the whole city under brute force. Call it False Positive - Incorrect Analytic Logic. A notable firing is not automatic proof of an attack.
Full Explanation
When a correlation search treats every municipal syslog line as a failed logon because a technical add-on maps the wrong field, the detection logic or field mapping is defective—disposition False Positive - Incorrect Analytic Logic. The notable fired because the analytic is miswired, not because the whole city is under credential attack. True Positive - Suspicious Activity fails by concept because a fired notable is not proof of malice when the search logic or CIM mapping is wrong. Benign Positive - Suspicious But Expected fails by concept because syslog noise from bad mapping is not authorized suspicious activity that the city expects; it is a broken analytic. Leaving the item Undetermined forever because mapping errors cannot be labeled fails by concept because Incorrect Analytic Logic is the defined disposition path that should drive engineering tuning. Exam caveat: SPLK-5001 expects False Positive - Incorrect Analytic Logic when field mapping or search logic is the root cause of civic false positives. Operational check: reproduce the bad field map with sample events, assign False Positive - Incorrect Analytic Logic, ticket engineering to fix the TA/CIM mapping or search, and verify failed-logon notables stop flooding after the fix.