Leadership asks the civic SOC analyst to write the Python for a new SOAR playbook after a library kiosk incident. What is in scope for the Cybersecurity Defense Analyst?
Select an answer to reveal the explanation.
Short Explanation
This exam is not a SOAR developer lab. The analyst skill is picking enrichment versus containment and knowing when to pull that trigger from ES. Leave the Python to the playbook authors.
Full Explanation
SPLK-5001 covers when and how to trigger SOAR playbooks from Enterprise Security, including choosing enrichment versus containment. Playbook authoring, SOAR install, custom integrations, and architect-scale sizing belong to sibling certifications. The library kiosk incident still needs the right trigger, not new Python from the analyst.