The CIO wants a civic-wide snapshot of notables by domain and urgency for the morning briefing, not a packet decode. Which built-in ES view fits?
Select an answer to reveal the explanation.
Short Explanation
Security Posture is the city-wide weather map. Leadership gets notables by domain and urgency, not a packet microscope. Save Stream decode for protocol questions.
Full Explanation
Security Posture (or the equivalent Enterprise Security overview) summarizes notables by security domain and urgency for a civic-wide morning briefing. That matches a CIO request for a snapshot of municipal risk posture rather than deep packet decode. A raw packet capture in Search fails by concept because PCAP-style investigation is deep network forensics on specific sessions, not an overview of notables by domain across the city. Opening Protocol Intelligence for every civic host fails by concept because Protocol Intelligence depends on Stream-like protocol telemetry and still does not replace the notable-by-domain briefing view. Using Incident Review Audit as live packet decode fails by concept because Audit shows how analysts handled notables over time—ownership and status changes—not packets, and it is not the morning posture snapshot. Exam caveat: SPLK-5001 maps Security Posture to high-level notable summaries and keeps protocol, packet, and audit views for their own jobs. Operational check: open Security Posture before the briefing, capture notables by domain and urgency for leadership, and drill to Analyst Queue or domain dashboards only when the CIO asks for case-level detail.