A.No other apps.

B.Any other apps installed.

C.All apps removed except for TA-*.

D.Only default built-in and CIM-compliant apps.

A.notable index

B.<splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

C.attachments.csv lookup

D.KV Store

A.Use new app names each time content is exported.

B.Do not use the .spl extension when naming an export.

C.Always include existing and new content for each export.

D.Either use new app names or always include both existing and new content.

A.1 minute

B.5 minutes

C.15 minutes

D.1 hour

A.Correlation editor.

B.Key indicator search.

C.Threat download dashboard.

D.Protocol intelligence dashboard.