Enterprise Security Incident Review Default Filter: What conf file is that store in?

[cmeisch]

In Incident Review, one can create a filter and save it as a default.  Where does it store that configuration so I can push it across multiple ES instances?

[ccl0utier]

See the answer to your other question here:  https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-does-the-incident-review-saved-filt...