A transit analyst says notables and Adaptive Response are mutually exclusive, so a correlation search that creates a notable is not using AR. What is the correct relationship?
Select an answer to reveal the explanation.
Short Explanation
Filing the case is itself a response action. In ES, create-notable is a standard Adaptive Response on the correlation search. Notable and AR are teammates, not rival products.
Full Explanation
Creating a notable is itself a common Adaptive Response of a correlation search; notables and Adaptive Response are not mutually exclusive products. A transit analyst who treats them as exclusive misunderstands that the Notable Event object on Analyst Queue is typically produced by the notable AR action configured on the search. Claiming they are mutually exclusive so creating a notable never uses Adaptive Response fails by concept because notable creation is implemented as an Adaptive Response in Enterprise Security. Rewriting the search as dashboard XML instead of using either object fails by concept because dashboards visualize posture or domains; they do not replace correlation-search AR for incident creation and tracking. Saying only ping and nslookup count as Adaptive Response while notables are a separate product fails by concept because notable, risk analysis, email, SOAR send, and enrichment actions are all AR types. Exam caveat: SPLK-5001 expects recognition that notable creation is an Adaptive Response, not a competing feature set. Operational check: open the correlation search in Content Management, show that Create Notable Event (or equivalent) is listed among Adaptive Responses, and explain to the transit team that filing the case is itself an AR.