A.owner===admin

B.created:>="7 days"

C.status:closed -category:job

D.role is Analyst

A.New tabs can be added to the incident layout

B.Layouts override classification and mapping

C.Layouts can display incident information and custom fields

D.Layouts add or remove custom fields from an incident type

A.Define a task in a playbook to generate an incident report before the closure occurs

B.Create an 'Incident Report' from the Reports page

C.Manually create an 'Incident Report'

D.Configure post-processing using a script

A.Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

B.Manually go through the incidents created by the raw events and link related incidents

C.Configure a pre-process rule to link related events as they are ingested

D.Process all alerts by running the respective playbook and link related incidents during post-processing