A school-district SOC lists ess_analyst versus ess_admin style permissions. Which pairing of work to ES capability is correct?
Select an answer to reveal the explanation.
Short Explanation
ess_analyst is the badge for the queue, not the keys to the building. Analysts live on Incident Review or Analyst Queue. Content, configuration, and acceleration stay with engineering and admin-style roles — not every ES login is ess_admin.
Full Explanation
Enterprise Security capabilities are split so Analysts can triage notables on Incident Review or the Analyst Queue without becoming app administrators. Engineering and admin-style roles own correlation-search content, configuration, and related settings such as data-model acceleration. Requiring admin rights to work the queue, or handing CIM acceleration to Analysts, collapses that split. Architects do not triage as their primary function, and Analysts do not configure the ES app as theirs.