Splunk Enterprise Security requires a dedicated search head with no other apps installed. This is because ES is a resource-intensive application that may cause performance issues and conflicts with other apps. Installing ES on a search head with other apps may also result in data loss or corruption. Therefore, it is recommended to install ES on a clean search head with only the default built-in apps and the Common Information Model (CIM) app. The CIM app is a prerequisite for ES and provides a common language for describing data across domains and technologies. The other options, B, C, and D, are not correct. Installing ES on a search head with any other apps, including TA-* or CIM-compliant apps, is not supported and may cause problems. References =

Install Splunk Enterprise Security

Splunk Enterprise Security Installation and Upgrade Manual

Adaptive responses are actions that can be performed in response to notable events or other security incidents. Adaptive responses can be triggered by correlation searches and users on the incident review dashboard. Correlation searches are scheduled searches that run periodically to detect patterns of interest in the data and generate notable events or other actions when the search conditions are met. Users can configure correlation searches to trigger adaptive responses automatically when a notable event is created. Users can also run adaptive responses manually from the incident review dashboard, which displays the notable events and their details. Users can select one or more notable events and choose an adaptive response action from the menu. Adaptive responses can help users to gather information, modify the environment, or take other actions to investigate and respond to security incidents. References =

Adaptive Response Framework overview

Run Adaptive Response actions from the Incident Review dashboard

The Add-On Builder is available from SplunkBase, which is the official source of apps and add-ons for the Splunk platform. SplunkBase allows you to browse, download, and install apps and add-ons that are compatible with your Splunk deployment. You can also upload and share your own apps and add-ons with the Splunk community. The Add-On Builder is a Splunk app that helps you build and validate technology add-ons for your Splunk Enterprise deployment. Technology add-ons are specialized add-ons that help to collect, transform, and normalize data feeds from specific sources in your environment.  The Add-On Builder guides you through the process of creating an add-on, following best practices and naming conventions, maintaining CIM compliance, and testing and validating the add-on 1 . The Add-On Builder is not available from GitHub, www.splunk.com, or the ES installation package. References =

Splunk Add-on Builder | Splunkbase

Splunk Add-on Builder | Splunkbase

The summariesonly=true option is a macro that modifies a correlation search to search only accelerated data. Accelerated data is the summary data that is generated by the data model acceleration process. Data model acceleration is a feature that speeds up searches and reports that use data models by pre-computing and storing the results of the data model queries. By using the summariesonly=true option, a correlation search can run faster and more efficiently, as it does not need to scan the raw events or the index time field extractions. However, the summariesonly=true option also requires that the data model acceleration is enabled and complete for the data model that the correlation search uses. Otherwise, the correlation search may not return any results or may miss some events that are not accelerated. References =

Use the summariesonly macro in Splunk Enterprise Security

Data model acceleration

According to the Splunk Enterprise Security documentation, one of the recommended pre-installation steps is to configure search head forwarding. Search head forwarding is a feature that allows the search head to forward its internal logs and metrics to an indexer or a heavy forwarder for indexing and analysis. This feature helps you monitor the health and performance of the search head and troubleshoot any issues that may arise. You can configure search head forwarding by editing the outputs.conf file on the search head and specifying the destination indexer or forwarder. See  Configure search head forwarding  for more details.

The other options are not recommended, because they are either unnecessary or harmful for the installation of ES. Disabling the default search app is not a good option, because it may cause some features of ES to not work properly, such as the Content Management page and the navigation editor. Downloading the latest version of KV Store from MongoDB.com is not a good option, because ES uses the built-in KV Store service that comes with Splunk Enterprise and does not require any external installation or configuration. Installing the latest Python distribution on the search head is not a good option, because it may cause compatibility issues with ES, which uses the Python version that comes with Splunk Enterprise. Therefore, the correct answer is B. Configure search head forwarding. References =  Configure search head forwarding .

 To add a new column to the Notable Event table in the Incident Review dashboard, you need to follow these steps:

On the Splunk Enterprise Security menu bar, click Configure > Incident Management > Incident Review Settings.

On the Incident Review Settings page, click the Table Attributes tab.

On the Table Attributes tab, click Add New Attribute.

Enter the name of the attribute that you want to add as a column, such as src or dest. The name must match the field name in the notable event data model.

Enter a label for the attribute that will appear as the column header, such as Source or Destination.

Enter a description for the attribute that will appear as a tooltip when you hover over the column header.

Select the data type for the attribute, such as string or number.

Select the visibility for the attribute, such as visible or hidden.

Click Save to save the new attribute.

Refresh the Incident Review dashboard to see the new column in the Notable Event table. References =

Add custom columns to the Incident Review dashboard in Splunk Enterprise Security

 The Remote Access panel within the User Activity dashboard is based on the Authentication data model, which contains information about authentication events from various sources, such as VPN, SSH, RDP, and others. The Authentication data model is accelerated by default, which means that it generates summary data to speed up searches. However, if the summary data is not up to date, the dashboard panel may not show the most recent data.  This can happen if the data model acceleration search is skipped, disabled, or encountering errors 1 2 .  To check the status of the data model acceleration, you can use the Data Model Audit dashboard in the Monitoring Console 3  or the | datamodel command in the Search app 4 .  References  =  1 : User Activity Monitoring - Splunk Documentation - Remote Access.  2 : About data model acceleration - Splunk Documentation.  3 : Use the Data Model Audit dashboard - Splunk Documentation.  4 : datamodel - Splunk Documentation.

 One way to test for a properly normalized data model is to run a | datamodel search against the data model or a dataset within the data model and compare the results to the CIM documentation for the datamodel. The CIM documentation provides the expected fields, tags, and constraints for each data model and dataset, as well as examples of normalized events. By running a | datamodel search, you can examine the JSON output of the data model or dataset and verify that it matches the CIM specifications. You can also use the search mode option of the | datamodel command to return either results or a search string that you can further inspect or modify.  For more information, see datamodel - Splunk Documentation 1  and Overview of the Splunk Common Information Model 2 .  References  =  1 : datamodel - Splunk Documentation  2 : Overview of the Splunk Common Information Model

 Notable event urgency is calculated by combining the severity set by the correlation search and the priority assigned to the associated asset or identity. The severity is a value that indicates the impact or importance of the event, such as low, medium, high, or critical. The priority is a value that indicates the significance or sensitivity of the asset or identity involved in the event, such as unknown, low, medium, high, or critical. The urgency is a value that indicates the level of attention or action required for the event, such as informational, low, medium, high, or critical. The urgency is determined by using the urgency_lookup, which maps the severity and priority values to the urgency values. For example, if the severity is high and the priority is medium, the urgency is high. If the severity is critical and the priority is critical, the urgency is critical.  You can use the urgency field to prioritize the investigation of notable events in Splunk Enterprise Security 1 . References =

How urgency is assigned to notable events in Splunk Enterprise Security

 The correct way to add a new lookup through the ES app is to upload the lookup file using Configure > Content Management > Create New Content > Managed Lookup. This allows the user to create or select an existing lookup file and definition, specify the lookup type, label, and description, and enable editing of the lookup file. This also stores the lookup file at the application level, which makes it easier to edit and share. The other options are either incorrect or not recommended for ES. Uploading the lookup file in Settings > Lookups > Lookup table files does not create a lookup definition or a label and description for the lookup. Uploading the lookup file in Settings > Lookups > Lookup Definitions does not upload the lookup file itself, but only creates a definition for an existing file. Adding the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups requires manual editing of the file system and is not recommended for ES. References =

Create and manage lookups in Splunk Enterprise Security