A wastewater analyst is about to write a brand-new search for historian setpoint changes. What should they do first?
Select an answer to reveal the explanation.
Short Explanation
Do not invent a historian hunt until Lantern and SSE have been checked. Supported content beats a one-off that duplicates what Splunk already documented. Python playbooks and cluster resizing are the wrong first move.
Full Explanation
Before writing a brand-new historian setpoint-change search, a wastewater analyst should check Splunk Lantern and Splunk Security Essentials for already-supported content. Supported, documented searches beat one-off detections that duplicate what Splunk already published for similar OT and security use cases. Authoring a custom Python SOAR playbook that queries the historian directly skips the SPL content-discovery step and jumps to automation engineering. Resizing the indexer cluster so index=* is 'safe' does not justify skipping content reuse. Copying a Boss of the SOC challenge stem into production is study material misuse, not a detection program. Exam caveat: if Lantern/SSE lack an exact historian setpoint use case, still reuse adjacent patterns (OT change, privileged session, config drift) rather than starting from a blank regex with no lineage. Operational check: search Lantern and SSE for historian, setpoint, or OT change content; if found, adapt and test; if not, document the gap, reuse the closest pattern, and file a content request before inventing a fully custom search. Document the revised approach in the civic SOC runbook so the next on-call analyst inherits the correct pattern rather than the anti-pattern. Retain Job Inspector evidence with the change ticket for municipal audit readiness.