On a fire-station notable, the Adaptive Response icon never shows success. What should the analyst check first?
Select an answer to reveal the explanation.
Short Explanation
A silent Adaptive Response icon is usually a locked door, a dead network path, or an action left off the search—not ES forgetting how to ping. Check enablement, permissions, and connectivity. Do not start by rewriting SPL.
Full Explanation
Failed Adaptive Response is diagnosed as configuration, permission, or search-head connectivity to the action, including whether AR is enabled on that correlation search. It is not a missing SPL command, a CIM Authentication tstats gap, or a notable-slug cosmetic. Ping as an action can still fail for those operational reasons.