Library SOC is onboarding a junior analyst. Which enablement pack should the lead hand them first?
Select an answer to reveal the explanation.
Short Explanation
New library analysts should get the official SPL shelves: SSE, Lantern, and open-the-notable's-search. A private regex wiki is folklore. Clustering runbooks and CySA+ cards do not teach civic ES investigation SPL.
Full Explanation
Analyst enablement for domain 5.3 starts with the named resources: Splunk Security Essentials, Splunk Lantern, and Enterprise Security objects such as a notable's contributing-event search. A private wiki of untested regex is not official SPL canon. Indexer clustering and license-master material are ES Admin / platform work. Vendor-neutral CompTIA decks do not replace ES, SSE, and Lantern as the search library.