The Zero-to-One app is designed to accelerate the deployment of RBA in Splunk ES. In less than two weeks you will be able to demonstrate end-to-end RBA functionality in your environment. The result being automatically enriched RBA notables for your analysts to review and respond to. Zero-to-One is built on best practices developed we’ve developed by deploying RBA to over 1 million endpoints.