What is the most efficient approach to identify the most commonly occurring processes across organization servers for baselining?

• A. Use the UDM lookup feature to identify relevant process-related UDM fields and values.
• B. Review the SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts marked as false positives.
• C. Run a UDM search, and review aggregations for relevant process-related UDM fields.
• D. Generate a SecOps SIEM dashboard that provides counts for process names and files.

Answer: (C)

To baseline the most common processes across organization servers, you want to pull the data and group it by the process field, counting how many times each process appears. This approach uses a UDM search with aggregations on relevant process-related fields (for example, process.name or process.path) to produce a direct, ranked list of the most frequent processes. It’s efficient because you get a single query that returns counts for each process, across all servers and systems, without having to manually inspect events or rely on noisy alerts.

Why this works best: aggregations summarize large datasets quickly and give you a clear top-N view of process activity, which is ideal for establishing a baseline. Once you identify the top processes, you can drill down into time windows, hosts, or variants to refine the baseline.

The other methods are less efficient for this goal. Looking up fields with a UDM lookup helps you identify which fields to use but doesn’t itself produce the frequency counts you need. Relying on alerts marked as false positives can be biased and not representative of actual normal activity. Building a dashboard is helpful for ongoing visibility, but it typically depends on having underlying aggregated data first; it’s not the most direct way to discover the top processes initially.