A city analyst must request a new correlation search for permitting-portal account-takeover signals. What understanding is enough for that request without becoming the Enterprise Security administrator?

In Splunk Enterprise Security for a municipal SOC, creating production correlation searches is primarily an engineering task, but the cybersecurity defense analyst must understand the moving parts well enough to request the right content. For permitting-portal account-takeover signals, that analyst-level request covers which CIM fields to detect on, which risk object type to score, what trigger conditions bound the adaptive responses, and whether the search should use risk analysis versus a notable. Knowing the full Enterprise Security app XML, indexer sizing, and KV-store replication for the search fails by concept because those are administrator and platform concerns outside SPLK-5001 analyst scope. Providing only the English title of the search and expecting engineers to invent fields and adaptive responses later fails by concept because an underspecified request yields wrong detections and noisy civic pages. Delivering a complete SOAR Python playbook that the search will call on the first matching row fails by concept because SOAR authoring is not required to specify a sound ES correlation-search request. Exam caveat: SPLK-5001 tests the analyst’s ability to specify CIM fields, risk object type, triggers, and adaptive responses—not ES admin XML or SOAR engineering. Operational check: draft a request for the permitting-portal ATO search that lists CIM fields, user versus system risk object, trigger bounds, and risk versus notable action; review it with ES content owners; and confirm the implemented search matches that design before enabling it in production.