Which of the following ES features would a security analyst use while investigating a network anomaly notable?

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

Which of the following is a way to test for a property normalized data model?

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering.
What feature would satisfy this requirement?