Splunk Administering Enterprise Security 5.3 questions with correct answers

Indexes CORRECT ANSWER notable = notable events created by correlation searches gia_summary = for Sec Intel > User Intel > Access Anomalies dashboard, filled by "Access - Geographically Improbable Access - Summary Gen" threat_activity = threat gen search matches(every 5 min) Roles CORRECT ANSWER ES User = Real time searches/view dashboards ES Analyst = Owns notable events/event status change, Start investigations, delete investigation entries ES Admin = Configures, manages corr. searches, add data, Delete Investigations Correlation Search Config CORRECT ANSWER Configure > Content > Content Management Analytic Stories CORRECT ANSWER Ready to use examples of how to use ES Splunk Enterprise Security Content Update (ESCU) add-on CORRECT ANSWER Subscription analytic story content Create Short ID CORRECT ANSWER - Notable Event Details - Notable Event Actions > Actions > Share Notable Event Action Menu - Incident Review (Notable Events) CORRECT ANSW