The SOC must assemble one permitting clerk's activity across sources instead of bouncing between five raw searches. Which ES capability is built for that?
Select an answer to reveal the explanation.
Short Explanation
One clerk, one investigator pane. User Intelligence stitches that identity across sources so you are not hopping five raw searches. Network-only or empty Stream views will miss half the story.
Full Explanation
User Intelligence / an identity investigator-style dashboard assembles one permitting clerk's activity across sources so the analyst is not bouncing between five raw searches. That Enterprise Security capability is built for an identity-centric story spanning authentication, web, and related civic telemetry. Recommending five raw index searches as the preferred method fails by concept because it ignores investigator views designed to reduce swivel-chair work and inconsistent pivots. Opening only the Network dashboard because clerks use firewalls fails by concept because a clerk investigation is not solely a firewall problem when identity activity spans auth, web, and endpoint. Opening Protocol Intelligence even when Stream is not onboarded fails by concept because those dashboards stay empty without protocol telemetry and still do not assemble a full cross-source identity story. Exam caveat: SPLK-5001 values identity investigator and User Intelligence workflows for cross-source civic user investigations. Operational check: open the identity investigator or User Intelligence view for the permitting clerk, review assembled panels across available mapped sources, then run targeted SPL only for gaps the dashboard does not cover.