The city SOC wants to hunt whether a valid finance account will create an inbox forwarding rule and then exfiltrate via personal cloud. What is the correct hypothesis-hunting sequence in Splunk?
Select an answer to reveal the explanation.
Short Explanation
A hunt without a hypothesis is a flashlight waved at the whole city. Write the story you can test, pick Email and Web data, search tightly, then say yes or no and write it down. Only then do you maybe promote a detection.
Full Explanation
Common Splunk hypothesis hunting starts with a specific, testable claim, maps it to data sources, runs constrained SPL, and records a confirm or refute. Promotion to a detection is optional and comes after the verdict. Inventing the hypothesis after a correlation search, scanning index=*, or containing first reverses that sequence.