A county SOC needs a 24-hour count of failed civic VPN logons by user. The Authentication data model is accelerated. Which SPL family should the analyst use?
Select an answer to reveal the explanation.
Short Explanation
When the Authentication model is already warmed up, tstats is the express lane. A raw index=* crawl is walking every street to count one parking lot. Use the summary; that is what acceleration is for.
Full Explanation
tstats reads accelerated data-model summaries and is the blueprint command for security aggregations such as failed VPN logons by user. A raw index=* scan is slower and ignores the CIM model the SOC already maintains. rex, makeresults, and foreach do not replace a summarized count. SPLK-5001 expects analysts to choose tstats for accelerated Authentication analysis.