A.Create notable event

B.Create investigation

C.Create new asset

D.Create new correlation search

A.ess_user

B.ess_admin

C.ess_analyst

D.ess_reviewer

A.An IP address rating.

B.A risk score.

C.A source ranking.

D.An event priority.

A.A risk score.

B.A source ranking.

C.An event priority.

D.An IP address rating.

A.Use Audit -> Normalization Audit and check the Errors panel.

B.Run a | datamodelsearch, compare results to the CIM documentation for the datamodel.

C.Run a | loadjobsearch, look at tag values and compare them to known tags based on the encoding.

D.Run a | datamodelsearch and compare the results to the list of data models in the ES normalization guide.