From a courts notable, the analyst runs ad-hoc ping and nslookup. What job do those Adaptive Response actions do compared with a risk notable?
Select an answer to reveal the explanation.
Short Explanation
Ping is looking out the window, not the whole case. Ad-hoc AR enriches a notable; a risk notable is the piled-up suspicion. Don't confuse a name lookup with aggregated risk.
Full Explanation
Ad-hoc Adaptive Response actions such as ping and nslookup run from a courts notable are enrichment: they gather network context during analysis so the analyst can confirm reachability or name resolution. They do not replace a risk notable that aggregates suspicion across contributing events on a risk object. Claiming ad-hoc ping is how ES creates risk notables fails by concept because risk notables come from aggregated risk crossing a threshold via risk-analysis AR, not from ICMP enrichment. Claiming successful nslookup closes the notable as True Positive fails by concept because DNS resolution success is operational context, not an analytic disposition of malice. Claiming ad-hoc Adaptive Response is the same object as a risk notable fails by concept because enrichment actions and risk notables are different ES constructs with different purposes and lifecycle. Exam caveat: SPLK-5001 separates enrichment Adaptive Response from risk aggregation and from disposition decisions on municipal cases. Operational check: use ping or nslookup as needed from the courts notable for context, expand risk contributing events if a risk notable exists, and set disposition from investigative evidence—not from enrichment success alone.