Library SOC is onboarding a junior analyst. Which enablement pack should the lead hand them first?
Select an answer to reveal the explanation.
Short Explanation
New library analysts should get the official SPL shelves: SSE, Lantern, and open-the-notable's-search. A private regex wiki is folklore. Clustering runbooks and CySA+ cards do not teach civic ES investigation SPL.
Full Explanation
Analyst enablement for Domain 5.3 starts with the official Splunk search and investigation shelves: Splunk Security Essentials for use-case content, Splunk Lantern for investigation articles and example searches, and the habit of opening a notable's contributing-event search inside Enterprise Security so juniors see how detections actually fire. Handing a new library SOC analyst that pack first builds reproducible civic investigation skills on real ES objects rather than folklore. A 40-page private wiki of untested regex copied from a forum is not official SPL canon and often breaks CIM or Asset and Identity assumptions when pasted into production. The ES indexer-clustering runbook and license-master screenshots are ES Admin and platform material; they do not teach a junior how to investigate library notables or adapt Lantern searches. A CompTIA CySA+ flashcard deck—even with Splunk stickers—remains vendor-neutral certification content and does not replace ES, SSE, and Lantern as the civic search library. Exam caveat: enablement resources named in the blueprint are ES, SSE, and Lantern plus opening contributing searches—not private regex dumps or admin clustering labs. Operational check: on day one, have the junior open SSE, open one Lantern investigation article, open a library notable's contributing-event search in ES, and walk through how those three sources answer the same investigation question before any custom regex is introduced.