County leadership asks the analyst to close civic tickets from the Risk Analysis dashboard. What is that dashboard actually for?
Select an answer to reveal the explanation.
Short Explanation
Risk Analysis is the scoreboard, not the close-ticket window. Use it to see who piled up risk and which events contributed. Closing work still happens on the queue.
Full Explanation
The Risk Analysis dashboard shows risk scores over time by object, annotations, and contributing risk—it exists so analysts and leadership can see who accumulated score and which events contributed. It is not where county tickets are dispositioned or closed; those workflow actions belong on Incident Review / Analyst Queue. Treating Risk Analysis as the ticket-close queue fails by concept because closing and disposition are Analyst Queue workflow actions on notables, not risk-score charts. Using Risk Analysis only to delete indexes after a risk notable fires fails by concept because index deletion is destructive administrative behavior unrelated to understanding risk and harms auditability. Calling it only for packet decode of Stream data fails by concept because packet and protocol decode belong with Stream or Protocol Intelligence, not with risk-object scoring views. Exam caveat: SPLK-5001 separates Risk Analysis (score storytelling) from Analyst Queue (workflow and disposition). Operational check: use Risk Analysis to brief leadership on rising civic risk objects and contributing events, then return to Analyst Queue to update owner, status, and disposition on the related notables.