Which type of event does operation:1 indicate in a SEDR database search?

Which type of event does operation:1 indicate in a SEDR database search?
A . File Deleted.
B . File Closed.
C . File Open.
D . File Created.

View Answer

Answer: C

Explanation:

In a Symantec Endpoint Detection and Response (SEDR) database search, an event labeled with operation:1 corresponds to a File Open action. This identifier is part of SEDR’s internal operation codes used to log file interactions. When querying or analyzing events in the SEDR database, recognizing this code helps Incident Responders understand that the action recorded was an attempt to access or open a file on the endpoint, which may be relevant in tracking suspicious or malicious activities.