Notable events in Splunk Enterprise Security (ES) are triggered by correlation searches, which generate alerts when suspicious activity is detected. However, if too many false positives occur, analysts waste time investigating non-issues, reducing SOC efficiency.
How to Improve Notable Events Effectiveness:
Apply suppression rules to filter out known false positives and reduce alert fatigue.
Refine correlation searches by adjusting thresholds and tuning event detection logic.
Leverage risk-based alerting (RBA) to prioritize high-risk events.
Use adaptive response actions to enrich events dynamically.
By suppressing false positives, SOC analysts focus on real threats, making notable events more actionable.
Thus, the correct answer is A. Applying suppression rules for false positives.
References:
Managing Notable Events in Splunk ES
Best Practices for Tuning Correlation Searches
Using Suppression in Splunk ES

The correct scheduling mode is Continuous . Continuous scheduling is designed for cases where the engineer wants the scheduled search to preserve coverage of every intended time interval, even if a particular execution cannot start exactly at its configured time.
With continuous scheduling, Splunk can run a delayed search later while still evaluating the originally intended time range. This helps prevent backfill gaps , where an interval would otherwise never be searched because the scheduler was busy or the search could not execute on time.
This differs from real-time-oriented scheduling behavior, which prioritizes execution close to the current scheduled time and may skip older scheduled instances when resources are constrained. For security detections, that can be undesirable if the requirement is complete historical coverage rather than lowest possible latency.
This same principle aligns with the supplied study material ' s treatment of detection scheduling and late- arriving data: engineers must design search windows and scheduling behavior so events are not missed simply because indexing or execution occurs later than expected.
Study Guide topics: correlation-search scheduling, continuous scheduling, backfill, scheduler delays, detection coverage, late-arriving data.

Splunk SOAR (Security Orchestration, Automation, and Response) helps SOC teams automate threat detection, investigation, and response by integrating security tools and orchestrating workflows.
Primary Purpose of Splunk SOAR:
Automates Security Tasks (B)
Reduces manual efforts by using playbooks to handle routine incidents automatically.
Accelerates threat mitigation by automating response actions (e.g., blocking malicious IPs, isolating endpoints).
Orchestrates Security Workflows (B)
Connects SIEM, threat intelligence, firewalls, endpoint security, and ITSM tools into a unified security workflow.
Ensures faster and more effective threat response across multiple security tools.

Splunk dashboards use tokens to capture and pass contextual values between dashboard elements, user interactions, and drilldown destinations. Therefore, tokens are the mechanism an engineer can use when a user selects a visualization element and the resulting value must be inserted into another search.
A token can represent contextual information derived from an interaction-for example, a selected host, username, source IP, destination, process, or time range. A drilldown can then use that value to construct a more focused search. Conceptually, a dashboard could capture a selected src value and pass it to a destination search so the analyst moves directly from an aggregate visualization to events associated with that source.
This design improves investigation efficiency because the analyst does not need to manually copy values from one interface into another search. It also preserves analytical context as the user moves from summary information to detailed evidence.
Aliases concern alternate representations of fields; environment variables are not the standard dashboard mechanism for passing selected visualization context; and JSON may define dashboard structures but is not itself the contextual-value mechanism being tested.
Study Guide topics: dashboard tokens, drilldowns, contextual searches, analyst workflow, dashboard interactivity, investigation efficiency.

For detections using a CIM data model, the data model's constraint macro defines which indexes are searched. This macro ensures that only relevant indexed data is pulled into the data model, controlling the search scope for detections.