To estimate dwell on a utilities risk object, the analyst needs when activity began. What timestamp should they take from the contributing events?
Select an answer to reveal the explanation.
Short Explanation
Dwell starts when the adversary first left a chip, not when the score looked scary. Grab the earliest contributing-event clock on that risk object. Do not confuse first(_time) on newest-first rows with the true start.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, dwell estimates depend on the earliest evidence of adversary presence on the risk object—not on when leadership noticed or when score peaked. From contributing events on a utilities risk object, take min(_time) or earliest(_time); use first(_time) only if rows are ordered oldest-first, because default newest-first search order makes first(_time) the latest stamp and would understate dwell. Treating the time the CIO asked about the notable as dwell fails by concept because leadership inquiry time is not adversary start time. Using only the latest contributing-event time because dwell starts when the queue was opened fails by concept because queue-open and latest event mark awareness or last activity, not initial presence. Using the correlation-search schedule interval as a proxy for attacker start time fails by concept because search cadence is a detection control, not evidence of when the adversary began. Exam caveat: SPLK-5001 expects earliest contributing-event time for civic dwell estimation and awareness that first(_time) is order-dependent. Operational check: list contributing events for the utilities risk object ordered by _time ascending, record min/earliest _time as dwell start, compare to notable create time for detection lag, and brief leadership with both dwell and detection-delay figures rather than CIO-ask time.