SPLK-3001 Exam Dumps : Splunk Enterprise Security Certified Admin Exam

The Splunk Add-on Builder helps you create technology add-ons, which are specialized add-ons that help to collect, transform, and normalize data feeds from specific sources in your environment. Technology add-ons are often referred to as TAs, and they start with the prefix TA-12. References = 1: Splunk Add-on Builder User Guide - About the Splunk Add-on Builder 2: Splunk Developer Portal - Develop Splunk Apps

 According to the Splunk Enterprise Security documentation, the Status Configuration window allows you to customize the status values and transitions for notable events. You can define which roles can change the status of a notable event from one value to another, and which roles can view the notable events with a specific status. To restrict the users with the ess_user role from being able to change the status of Resolved notable events to closed, you need to do the following steps:

• On the Enterprise Security menu bar, select Configure > Incident Management > Status Configuration.
• In the Status Configuration window, select the Resolved status from the list of values.
• In the Status Transitions section, find the row for the closed status and click the Edit icon.
• In the Edit Status Transition dialog box, remove the ess_user role from the Roles field and click Save.
• Click Save Changes to apply the changes to the Status Configuration window.

This will prevent the users with the ess_user role from changing the status of any notable event from Resolved to closed. They will still be able to change the status of other notable events to closed, if they have the permission to do so. Therefore, the correct answer is A. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status. References = Customize status values and transitions for notable events.

 According to the Splunk Enterprise Security documentation, the bar across the bottom of any ES window is called the Investigation Bar. The Investigation Bar is a tool that helps you create and manage investigations in ES. An investigation is a collection of related notable events, comments, and artifacts that document a security incident or a threat hunting activity. You can use the Investigation Bar to do the following tasks:

• Create a new investigation or open an existing one.
• Add notable events, comments, and artifacts to an investigation.
• Assign an owner and a status to an investigation.
• Share an investigation with other users or roles.
• Export an investigation as a PDF report.

The Investigation Bar also provides a link to the Investigation Workbench, which is a dashboard that shows a timeline and a summary of an investigation. Therefore, the correct answer is B. The Investigation Bar. References = Use the Investigation Bar.