A.Configuring correlation permissions.

B.Configuring correlation notable event index.

C.Configuring correlation adaptive responses.

D.Configuring correlation result storage.

A.The investigation owner only.

B.The investigation owner and ess-admin.

C.ess_admin users only.

D.The investigation owner and collaborators.

A.When adding apps to the deployment server.

B.Splunk_TA_ForIndexers.splis installed first.

C.After installing ES on the search head(s) and running the distributed configuration management tool.

D.Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundlecommand.

A.REST API invocations.

B.Investigation final results status.

C.Workstations, notebooks, and point-of-sale systems.

D.Lifecycle auditing of incidents, from assignment to resolution.

A.From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.

B.Edit the Threat Activity view settings and checkmark the Default View option.

C.From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.

D.From the Preferences menu for the user, select Enterprise Security as the default application.