A.Upload the lookup file in Settings -> Lookups -> Lookup Definitions

B.Upload the lookup file in Settings -> Lookups -> Lookup table files

C.Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups

D.Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

A.Indexers might crash.

B.Indexers might be processing.

C.Indexers might not be reachable.

D.Indexers have different settings.

A.IP address.

B.Combination of Last Name, First Name.

C.Email.

D.Nickname

A.Asset priority and threat weight.

B.Alert severity found by the correlation search.

C.Asset or identity risk and severity found by the correlation search.

D.Severity set by the correlation search and priority assigned to the associated asset or identity.