The SOC must assemble one permitting clerk's activity across sources instead of bouncing between five raw searches. Which ES capability is built for that?
Select an answer to reveal the explanation.
Short Explanation
One clerk, one investigator pane. User Intelligence stitches that identity across sources so you are not hopping five raw searches. Network-only or empty Stream views will miss half the story.
Full Explanation
User Intelligence and identity investigator dashboards assemble one user's activity across contributing sources. That is faster and more complete than ad-hoc raw searches for a single civic identity. Restricting the view to Network, or opening Protocol Intelligence without Stream data, leaves gaps. Investigator dashboards are the 4.5 tool for one-identity stories.