An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?

Question

Options

• ARunning the Risk Analysis Adaptive Response action within the Notable Event.
• BVia a workflow action for the Risk Investigation dashboard.
• CVia the Risk Analysis dashboard under the Security Intelligence tab in Enterprise Security.
• DClicking the risk event count to open the Risk Event Timeline.

• A
  4% (1)
• B
  4% (1)
• D
  92% (24)

Explanation

Clicking the risk event count link on a Risk Object within the Splunk ES Incident Review panel opens the Risk Event Timeline - a visualization that displays both associated threat objects across the environment and a chronological view of risk events tied to that specific object. This is the native, in-context path designed precisely for this use case.

Why the distractors are wrong:

• A - The Risk Analysis Adaptive Response action triggers an investigative action (searching/enriching), not a visual timeline of risk events.
• B - Workflow actions can launch external dashboards, but there is no standard "Risk Investigation dashboard" accessed this way for the chronological view described.
• C - The Risk Analysis dashboard under Security Intelligence provides an environment-wide risk overview, not a per-Risk-Object chronological event timeline launched from within Incident Review.

Memory tip: Think "count → clock" - clicking the count of risk events opens the chronological (clock-ordered) Risk Event Timeline. The number is the door; the timeline is what's behind it.

No community discussion yet for this question.