A security manager has been working with the executive team on long-range security goals. A primary goal for the team is to improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?
To identify users accessing inappropriate websites, configuring user and website watchlists is essential. This setup allows the User Activity dashboard to highlight unwanted user actions effectively, which directly addresses the goal of managing user risk within the organization by monitoring their web activities. Making sure the authentication data model is up-to-date or configuring the identities lookup helps with different aspects of security but does not specifically target identifying inappropriate web access.
B is correct. Pag. 283 "Watchlisting Identities" - "Administering Splunk ES 7.1"