What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)
What is the default configuration for indicator auto-extraction when incidents are created?
Which investigation element is best suited for collaboration among users?
In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)
Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)