The city SOC wants to hunt whether a valid finance account will create an inbox forwarding rule and then exfiltrate via personal cloud. What is the correct hypothesis-hunting sequence in Splunk?
Select an answer to reveal the explanation.
Short Explanation
A hunt without a hypothesis is a flashlight waved at the whole city. Write the story you can test, pick Email and Web data, search tightly, then say yes or no and write it down. Only then do you maybe promote a detection.
Full Explanation
Common Splunk hypothesis hunting follows a deliberate sequence: write a specific, testable hypothesis, identify the data sources that could confirm or refute it, run constrained SPL against those sources, record a confirm or refute, then document the outcome and optionally promote a detection. For a city SOC hunting whether a valid finance account will create an inbox forwarding rule and then exfiltrate via personal cloud, that means stating the forwarding-plus-exfil claim, mapping it to Email and Web (or proxy) data, searching those sourcetypes with bounds, and documenting the verdict before any correlation-search promotion. Promoting a correlation search first and inventing a hypothesis only if it fires reverses the sequence and skips the testable claim. Running unbounded index=* searches until something looks interesting, then naming the tactic, is unfocused exploration rather than hypothesis hunting. Isolating the mail server and writing the hypothesis after containment puts destructive response ahead of proving the story in Splunk. Exam caveat: SPLK-5001 expects hypothesis → data → constrained search → verdict → optional detection, not detection-first or contain-first workflows. Operational check: write the finance forwarding-and-cloud-exfil hypothesis in one sentence, name Email and Web sources, run time-bounded SPL for new inbox rules and rare personal-cloud destinations for finance identities, and log confirm or refute before changing any correlation search.