A.Use Audit -> Normalization Audit and check the Errors panel.

B.Run a | datamodelsearch, compare results to the CIM documentation for the datamodel.

C.Run a | loadjobsearch, look at tag values and compare them to known tags based on the encoding.

D.Run a | datamodelsearch and compare the results to the list of data models in the ES normalization guide.

A.An urgency.

B.A risk profile.

C.An aggregation.

D.A numeric score.

A.An urgency.

B.A risk profile.

C.An aggregation.

D.A numeric score.

A.modular_history

B.modular_action_history

C.cim_adaptiveactions

D.cim_modactions

A.Click the "Add IOC" button.

B.Add it in a text note to the investigation.

C.Click the "Add Artifact" button.

D.Paste it into Notepad.