[&] In which scenario would you use the demo virtual machine for TheHive?
- For customer-facing service environments
- For production deployment
- For enhancing network infrastructure
- For testing the full functionality of the platform without installation

[&] How can a user perform enrichment of an indicator of compromise (IOC) within TheHive?
- By running a separate network scan
- By manually editing the IOC descriptions
- By activating integration with third-party antivirus services
- By using Cortex analyzers

[&] What feature of TheHive allows for creating reusable procedures for specific incident types?
- Virtual Machine Settings
- Built-in Firewall
- Case Templates
- Notification System