The Enterprise Security Data Library (ESDL) provides a baseline of the data sources available in a Splunk environment. It helps identify which data sources are present, how they map to security use cases, and whether they align with Enterprise Security requirements.

Zero Trust is a security methodology that helps prevent malicious lateral movement by enforcing the principle of "never trust, always verify." It restricts access based on continuous verification, least privilege, and microsegmentation, making it harder for attackers to move laterally within the network.

Risk-based detection in Splunk prioritizes alerts based on behavior, threat intelligence, and business impact.
Enhancing risk scores and enriching contextual data ensures that SOC teams focus on the most critical threats.
Methods to Enhance Risk-Based Detection:
Defining Accurate Risk Modifiers (A)
Adjusts risk scores dynamically based on asset value, user behavior, and historical activity.
Ensures that low-priority noise doesn't overwhelm SOC analysts.
Enriching Risk Objects with Contextual Data (D)
Adds threat intelligence feeds, asset criticality, and user behavior data to alerts.
Improves incident triage and correlation of multiple low-level events into significant threats.

Splunk SOAR (Security Orchestration, Automation, and Response) helps SOC teams automate threat detection, investigation, and response by integrating security tools and orchestrating workflows.
Primary Purpose of Splunk SOAR:
Automates Security Tasks (B)
Reduces manual efforts by using playbooks to handle routine incidents automatically.
Accelerates threat mitigation by automating response actions (e.g., blocking malicious IPs, isolating endpoints).
Orchestrates Security Workflows (B)
Connects SIEM, threat intelligence, firewalls, endpoint security, and ITSM tools into a unified security workflow.
Ensures faster and more effective threat response across multiple security tools.

A detection should be reviewed or retuned as defined by the established detection lifecycle (DDLC). This ensures detections are consistently evaluated for accuracy, effectiveness, and alignment with evolving threats, rather than only reacting to false positives or inactivity.