The city SOC needs the built-in queue of notables and findings with title, urgency, owner, status, disposition, and time. Which dashboard is that?
Select an answer to reveal the explanation.
Short Explanation
Analyst Queue is the inbox. Title, urgency, owner, status, disposition, time—that is Incident Review, not protocol decode or license graphs. Triage lives there.
Full Explanation
Incident Review (Analyst Queue in current ES language) is the built-in triage dashboard for notables and findings. It exposes title, urgency, owner, status, disposition, and time so analysts can filter and work the queue. Protocol Intelligence is for stream and protocol data, and license or indexer views are platform operations, not the SOC work queue.