A clerk-account risk notable is in the city queue. What is the intended sequence using the notable, contributing events, and SPL together?
Select an answer to reveal the explanation.
Short Explanation
Open the case, read the receipt, then go look for more. That is notable, then contributing events, then SPL on src. Skipping the notable or wiping the PC first is backwards.
Full Explanation
Analysts triage the notable (or finding) on Analyst Queue, expand contributing events to understand why the score crossed threshold, then use SPL against entity fields such as src, user, or dest to gather additional evidence. That sequence is how Domain 4 terms are meant to work together on one civic case. Inventing contributing events outside ES, closing as False Positive unread, or remediating before analysis inverts Splunk's investigation sequence and wastes the risk story ES already assembled.