A county IR hunt and a heavy weekly compliance report are competing with 911 monitoring searches on the shared search head. What efficient-search courtesy should the analyst apply?
Select an answer to reveal the explanation.
Short Explanation
The search head is a shared firehouse pole — a sloppy All Time IR hunt can knock 911 monitoring off it. Park heavy reports after hours and keep the live hunt tight so dispatch searches still get CPU.
Full Explanation
On a shared search head, heavy weekly compliance reports and unconstrained IR hunts can starve 911 monitoring searches that must stay responsive for public safety. Efficient-search courtesy means scheduling heavy civic reports off-peak and keeping ad-hoc IR searches tightly constrained by time, index, and sourcetype so emergency monitoring retains CPU and concurrency. Running compliance and IR as index=* All Time maximizes contention rather than relieving it. Disabling 911 monitoring until IR finishes endangers the civic monitoring mission the SIEM exists to support. Switching monitoring searches to verbose mode does not help IR and compliance share capacity; it increases load. Exam caveat: priority and workload management are operational controls alongside SPL efficiency—good filters still matter when multiple tenants share the search head. Operational check: move the weekly compliance report to an off-peak schedule, cap the IR hunt's time and index scope, and verify 911 monitoring search latency returns to baseline during the next IR exercise. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.