A junior hunter proposes the hypothesis that hackers are here on the elections network. What change makes it a testable Splunk hunt hypothesis?
Select an answer to reveal the explanation.
Short Explanation
Saying hackers are here is like saying something is wet during a flood. Name the tactic and the civic identity or asset so Splunk has somewhere to look. Vague hunts never refute anything.
Full Explanation
A useful hypothesis names the tactic or technique and the municipal identity or asset under test so SPL can confirm or refute it. Broadening the claim, waiting on dashboards, or jumping to playbook authoring avoids that specificity. Defense Analyst hunting starts with a testable story, not a slogan.