To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

How does ES know local customer domain names so it can detect internal vs. external emails?

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

What do threat gen searches produce?

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?