SOC › Module 5 › Lesson 5
Quiz — Correlation
10 APPLY items on correlation, dashboards, and L2 tuning on $HUNT_LAB.
Opening
Correlation and Dashboards — Module Quiz
Ten APPLY items. Name correlation and dashboard concepts on YOUR $HUNT_LAB scenarios — never unauthorized prod deploy, stranger SIEM edits, or offensive playbooks. Original Cyberlium. Next: PICERL Named.
Knowledge Check
APPLY: Correlation joins sources by:
Multiple choice
Knowledge Check
APPLY: True or False: UTC timestamps improve multi-source correlation.
True or False
Knowledge Check
APPLY: L2 hunt dashboards may include:
Multiple choice
Knowledge Check
APPLY: Tutorial edits production rules without ticket — you:
Multiple choice
Knowledge Check
APPLY: L2 tuning proposals should include:
Multiple choice
Knowledge Check
APPLY: jq KPI from lab jsonl supports:
Multiple choice
Knowledge Check
APPLY: Cyberlium NEVER allows:
Multiple choice
Knowledge Check
APPLY: True or False: Multi-source correlation improves hunt narrative quality.
True or False
Knowledge Check
APPLY: chmod 600 on correlation notes means:
Multiple choice
Knowledge Check
APPLY: Next lesson after this quiz:
Multiple choice
Answer all 10 knowledge checks to continue. (0/10 answered)