A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

ES needs to be installed on a search head with which of the following options?

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

Which of the following features can the Add-on Builder configure in a new add-on?