Explanation
In order to include an eventtype in a data model node, you need to apply the correct tags to the eventtype. Tags are labels that you can assign to event types to identify them as belonging to a specific category or domain.
Tags are used by data models to map event types to data model nodes. For example, if you have an eventtype named windows_performance that contains events related to Windows performance metrics, you can tag it with performance and os. Then, you can include the eventtype in a data model node that matches those tags, such as the Performance node in the Operating System data model12. To apply tags to an eventtype, you can use the Settings > Event types page in Splunk Web, or the eventtypes.conf and tags.conf configuration files3.
References = 1: About data models – Splunk Documentation – How data models use tags. 2: Use tags to map event types to data model nodes – Splunk Documentation. 3: About event types – Splunk Documentation – Tag event types.

Explanation
Adaptive response action history is stored in the cim_modactions index. This index contains the events generated by the adaptive response actions that are triggered by correlation searches or run manually from Incident Review. You can use this index to search, audit, and report on the adaptive response actions that have been executed in your environment. You can also view the adaptive response action history on the Adaptive Response dashboard in Enterprise Security1. References = Adaptive Response dashboard – Splunk Documentation

Explanation
The correct answer is B. Normalize data. The Add-on Builder can configure a new add-on to normalize data by mapping the data fields to the Common Information Model (CIM). The CIM provides a common language for describing data across domains and technologies. Normalizing data enables the data to be used by other Splunk apps, such as Splunk Enterprise Security and Splunk IT Service Intelligence. The Add-on Builder can also configure other features in a new add-on, such as collecting data from various sources, extracting fields from the data, creating alert actions and adaptive response actions, and testing and validating the add-on.
However, the Add-on Builder cannot configure an add-on to expire data, summarize data, or translate data.
These are not features of the Add-on Builder. References =
Splunk Add-on Builder
[Use the Common Information Model in Splunk Web]

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Install/Planyourdatainputs

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskScoring

Explanation
After installing the add-ons necessary for normalizing data, you should configure the add-ons according to their README or documentation. The add-ons that are included in the Splunk Enterprise Security package are preconfigured and do not require additional steps. However, the add-ons that are downloaded separately from Splunkbase may require additional configuration steps, such as enabling inputs, setting up credentials, or modifying props and transforms. You should review the README or documentation for each add-on to determine the specific configuration requirements and follow the instructions accordingly. References = Deploy add-ons to Splunk Enterprise Security About installing Splunk add-ons

Explanation
Correlation searches are scheduled searches that run in Splunk Enterprise Security to detect security incidents or other notable events. They can consume a lot of resources and affect the overall search performance. To improve the search performance, you can do the following actions:
Reduce the frequency (schedule) of lower-priority correlation searches. This will reduce the number of searches that run concurrently and free up some resources for other searches. You can edit the schedule of a correlation search in the Content Management page of Splunk Enterprise Security. See Edit a correlation search in Splunk Enterprise Security for more details.
Add notable event suppressions for correlation searches with high numbers of false positives. This will prevent the correlation search from generating notable events that are not relevant or actionable, and reduce the load on the Notable Event Framework. You can add suppression rules for a correlation search in the Content Management page of Splunk Enterprise Security. See Suppress notable events in Splunk Enterprise Security for more details.
The other two actions are not recommended, because they can have negative effects on the search performance or the security posture. Disabling indexed real-time search can cause some dashboards and panels to not display data correctly, and increasing the priority of all correlation searches can cause resource contention and degrade the performance of other searches. See Optimize Splunk Enterprise for peak performance and How search types affect Splunk Enterprise performance for more information. References = Edit a correlation search in Splunk Enterprise Security Suppress notable events in Splunk Enterprise Security Optimize Splunk Enterprise for peak performance How search types affect Splunk Enterprise performance

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Createlookups

Explanation
The upgraded contents of the staging instance will be migrated back to the deployer and deployed to the search head cluster members. On the staging instance, copy $SPLUNK_HOME/etc/apps to
$SPLUNK_HOME/etc/shcluster/apps on the deployer. 1. On the deployer, remove any deprecated apps or add-ons in $SPLUNK_HOME/etc/shcluster/apps that were removed during the upgrade on staging. Confirm by reviewing the ES upgrade report generated on staging, or by examining the apps moved into
$SPLUNK_HOME/etc/disabled-apps on staging

Reference:
https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskAnalysis#Dashboard_panels

Explanation/Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

Explanation
According to the Splunk Enterprise Security documentation, only users with the ess_admin role or the Manage All Investigations capability can delete an investigation. The investigation owner and collaborators can edit the investigation, but not delete it. Therefore, the correct answer is A. ess_admin users only.
References = Manage investigations in Splunk Enterprise Security

Explanation
Splunk Enterprise Security supports downloading threat intelligence from STIX/TAXII servers. STIX is a structured language for describing cyber threat information, and TAXII is a protocol for exchanging STIX data. Splunk Enterprise Security can download STIX/TAXII feeds from any server that supports the TAXII
1.1 specification and the STIX 1.1.1 or 1.2 specification. Splunk Enterprise Security does not support downloading threat intelligence from text, VulnScanSPL, or Splunk Enterprise Threat Generator sources.
References = Add threat intelligence to Splunk Enterprise Security, Upload a STIX or OpenIOC structured threat intelligence file

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecuritySHC