Knowledge CheckPass mark 80%+60 XP

Module 3 Knowledge Check — Threat Hunting Leadership

Pass mark 80%1 / 3

You are about to run a hunt query. When should the decision rule (what confirms vs refutes) be written?

A.After seeing the results, so it fits what you found.B.Before running the query, so the result is unambiguous either way.C.Only if the hunt confirms.D.Never — hunts do not need decision rules.