Nightly authorized vulnerability scans of the library catalog keep creating the same notables. The search logic is correct. What should the analyst use so those known-benign items leave the working queue without deleting history?
Select an answer to reveal the explanation.
Short Explanation
The nightly library scan is a scheduled drill, not a break-in. Suppression tucks those notables out of the working pile without shredding the evidence. Rewrite the search only when the logic itself is wrong.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, Analyst Queue suppression hides matching notables from the working Incident Review view while retaining them in the notable index for audit and later review. When nightly authorized vulnerability scans of the library catalog correctly match a sound correlation search, suppression for that known-benign pattern clears the working queue without deleting history or rewriting detection logic. Rewriting the correlation search to drop all library sourcetypes, including real attacks, fails by concept because it punches a permanent blind spot in civic library telemetry to silence a scheduled scan. Deleting matching rows from the notable index after each scan window fails by concept because it destroys audit evidence and breaks disposition history. Changing every matching disposition to True Positive so the queue looks handled fails by concept because True Positive means a real incident, which misstates authorized scanning and poisons metrics. Exam caveat: SPLK-5001 distinguishes suppression for known-benign authorized activity from search rewrites, deletions, and false dispositions. Operational check: define an Analyst Queue suppression for the authorized library scan window and identifiers, confirm matching notables leave the working queue but remain queryable in the notable index, and schedule a periodic review so the suppression does not outlive the scan program.