A new courts-SOC analyst thinks reusable security SPL exists only i…

Question

A new courts-SOC analyst thinks reusable security SPL exists only in the Search app. Where else in Enterprise Security should they look?

Accepted Answer

Correlation-search definitions, investigation workbench searches, and Security Domain dashboard drilldowns. — The Search app is not the only drawer of working security SPL. ES itself ships correlation-search definitions, investigation workbench searches, and Security Domain drilldowns. Clustering, license, and KV Store screens are admin furniture, not the analyst's SPL library.

Answer

Only in indexer clustering dashboards, because those store the canonical CIM searches.

Answer

The license-master usage report, which lists every SPL string billed this month.

Answer

KV Store admin pages, which hold the raw search macros used during ES installation.

A new courts-SOC analyst thinks reusable security SPL exists only in the Search app. Where else in Enterprise Security should they look?

Short Explanation

Full Explanation