A city attorney asks what a courthouse notable actually means. The analyst has the correlation-search SPL and an annotation whose tactic name is Credential Access. Which language should the analyst use in the briefing?

When a city attorney asks what a courthouse notable actually means, the analyst should brief in the annotation's tactic language—Credential Access, Persistence, Defense Evasion, and similar labels—because those names explain the adversary goal in framework vocabulary stakeholders can follow. Enterprise Security already prints that chapter title on the notable so legal, executive, and audit audiences hear intent rather than SPL. The correlation-search query remains essential for engineers validating logic, but it is the wrong primary language for a non-technical briefing.

Leading with raw SPL and eval statements fails by audience: attorneys need risk narrative and adversary goal, not search syntax. Pointing only to the indexer cluster map fails by role—topology diagrams are operations artifacts and do not interpret why a civic notable matters. Elevating an Adaptive Response ping result as the only non-technical explanation confuses network reachability checks with ATT&CK tactic meaning; ping success or failure does not translate Credential Access for counsel.

Exam caveat: SPLK-5001 emphasizes using annotations as the analyst-facing and stakeholder-facing layer; do not equate "explain the notable" with "paste the SPL" or "show the cluster map."

Operational check: before the briefing, open the courthouse notable on Incident Review, note the annotated tactic (and technique if present), prepare one sentence that ties that tactic to observed civic impact, and keep SPL and Adaptive Response detail in an appendix for technical follow-up rather than the opening slide.