A true-positive notable never appears in Splunk SOAR. Where should the civic SOC troubleshoot first?
Select an answer to reveal the explanation.
Short Explanation
If SOAR never saw the notable, follow the hallway between ES Adaptive Response and the SOAR app—not the CIM Authentication model. Connectivity and AR config are the usual broken tiles. tstats versus stats is the wrong wing of the building.
Full Explanation
Failed ES-to-SOAR triggering is diagnosed along the Adaptive Response and SOAR export or app path. CIM Authentication, search-command choice, and Pyramid of Pain ranking do not move a notable into SOAR. Analysts verify AR is configured on the detection and that the SOAR connection is healthy.