Question 1

Which of the following is true about the preview feature and macros?

Options :

A : The preview feature expands only the selected macro within the search.

B : The preview feature can be launched using Tab-Shift-E on Mac or Windows.

C : The preview feature can be launched by right-clicking on the macro name in the search string.

D : The preview feature expands all macros within the search, including nested macros.

Answer: D

Question 2

What is an example of the simple XML syntax for a base search and its post-srooess search?

Options :

A :

B :

C :

D :

Answer: A

Question 3

How is regex passed to the makemv command?

Options :

A : makemv be preceded by the erex command.

B : It is specified by the delim argument.

C : It Is specified by the tokenizer argument.

D : Makemv must be preceded by the rex command.

Answer: B

Question 4

Which of the following cannot be accomplished with a webhook alert action?

Options :

A : Retrieve data from a web page

B : Create a ticket in a support app

C : Post a notification on a web page

D : Post a message in a chatroom

Answer: A

Question 5

Which of the following is true about a KV Store Collection when using it as a lookup?

Options :

A :

Each collection must have at least 3 fields, one of which needs to match values of a field in your event data

B :

Each collection must have at least 2 fields, one of which needs to match values of a field in your event data.

C :

Each collection must have at least 2 fields, none of which need to match values of a field in your event data.

D :

Each collection must have at least 3 fields, none of which need to match values of a field in your event data.

Answer: B