Following the Installation of ES, an admin configured Leers with the ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

Which of the following threat intelligence types can ES download? (Choose all that apply)

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Which indexes are searched by default for CIM data models?

Which of the following is a key feature of a glass table?