A risk notable fired on the treasurer identity. The analyst needs to explain why the score exists before briefing finance. What should they expand?
Select an answer to reveal the explanation.
Short Explanation
Think itemized receipt under the total. Contributing events are the cheap hits that added up on the treasurer. The cluster map and the license graph will not explain the score to finance.
Full Explanation
Contributing events—also called intermediate findings or risk events—are the individual scored items that explain a risk notable. Expanding them lets the analyst reconstruct why the treasurer identity crossed threshold (rare VPN, mailbox rule, off-hours admin) before briefing finance stakeholders who need the itemized story, not just a total. Looking at the indexer cluster map because contributing events supposedly live on peer nodes fails by concept because peer topology is infrastructure operations and does not narrate the scored story behind a risk notable. Reading only the original raw syslog with risk annotations stripped fails by concept because stripping discards the scored trail Enterprise Security already built and forces the analyst to rebuild context manually. Checking the license-master daily quota graph fails by concept because license usage is an operational capacity view, not contributing-event evidence for a treasurer compromise narrative. Exam caveat: SPLK-5001 expects analysts to expand contributing events to explain risk notables to civic stakeholders. Operational check: from the treasurer risk notable, expand contributing events, note timestamps and rule names, validate key events with follow-up SPL on the entity, and use that itemized receipt in the finance briefing.