Explanation
When investigating an incident in Splunk Enterprise Security, the best way to store a newly-found IOC (indicator of compromise) is to click the "Add Artifact" button. This button allows you to add an artifact to the current investigation from any dashboard or search result. An artifact is a piece of machine data that indicates risk, such as an IP address, a domain name, a file hash, or a user name. By adding an artifact to the investigation, you can enrich the context of the incident, track the artifact across multiple data sources, and share the artifact with other analysts. You can also use the artifact to create a threat intelligence indicator, which can be used to detect and alert on future threats12. References = 1: Add artifacts to an investigation - Splunk Documentation. 2: About investigations in Splunk Enterprise Security - Splunk Documentation.