Which role is most appropriate when a user only needs to view SIEM investigations and...

The least-privilege role for users who only need to view dashboards, searches, and investigation data without making changes is NG SIEM Analyst – Read Only . This role is designed for visibility without content modification or administrative access. The other roles provide broader operational or management permissions.

==========