What role should be assigned to a security team member who will be taking ownership of notable event

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

A. ess_user

B. ess_admin

C. ess_analyst
D. ess_reviewer

Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents