A county IR hunt and a heavy weekly compliance report are competing with 911 monitoring searches on the shared search head. What efficient-search courtesy should the analyst apply?
Select an answer to reveal the explanation.
Short Explanation
The search head is a shared firehouse pole — a sloppy All Time IR hunt can knock 911 monitoring off it. Park heavy reports after hours and keep the live hunt tight so dispatch searches still get CPU.
Full Explanation
Civic SOCs share search capacity between continuous monitoring and investigations. Efficient practice is to schedule heavy reports off-peak and to constrain ad-hoc IR searches by time, index, sourcetype, and transforming commands so they do not crowd out 911 monitoring. index=* All Time, disabling monitoring, and switching monitors to verbose mode all harm that shared workload. Courtesy here is an efficient-search skill, not an indexer-clustering admin task.