A sheriff-jail SOC analyst has a new case that looks like last week's notable. What is a legitimate way to start the investigation SPL?
Select an answer to reveal the explanation.
Short Explanation
Last week's notable already ran a search that found the contributing events. Open that search and reuse it; that is stealing in the good way. Rewriting CIM or dumping to Excel just throws away working jail-SOC SPL.
Full Explanation
A notable's contributing-event search is a first-class ES SPL resource: it is the query that produced the evidence behind the finding. Reusing it for a similar civic case is expected analyst practice, not a workaround. Rebuilding CIM field extraction, exporting to Excel, or disabling the correlation search discards tested SPL and is outside the 5.3 resource objective. The analyst still scopes time and assets for the new jail case, but starts from the search that already worked.