A true-positive notable never appears in Splunk SOAR. Where should the civic SOC troubleshoot first?
Select an answer to reveal the explanation.
Short Explanation
If SOAR never saw the notable, follow the hallway between ES Adaptive Response and the SOAR app—not the CIM Authentication model. Connectivity and AR config are the usual broken tiles. tstats versus stats is the wrong wing of the building.
Full Explanation
When a true-positive notable never appears in Splunk SOAR, the civic SOC should troubleshoot first along the Enterprise Security Adaptive Response configuration and the SOAR export or app connectivity path—the hallway between ES and SOAR—rather than re-tuning unrelated search constructs. Verify that Send to SOAR or equivalent AR is enabled on the detection, that credentials and app configuration are healthy, and that the search head can reach SOAR before assuming content problems. The CIM Authentication data model acceleration window does not move notables into SOAR and is the wrong first stop for a missing SOAR event. Whether the notable used tstats instead of stats affects search performance and data-model usage, not whether AR delivered the notable to SOAR. The Pyramid of Pain ranking of the associated hash is a detection-value framework and does not control ES-to-SOAR transport. Exam caveat: failed ES-to-SOAR appearance is an Adaptive Response and connectivity diagnosis first—not CIM Authentication, stats-versus-tstats, or Pyramid of Pain. Operational check: confirm AR Send to SOAR on the true-positive detection, test SOAR app connectivity from the search head, manually retry Send to SOAR from the notable, and verify the event appears in SOAR before changing data models or search commands.