A hospital security team keeps seeing one internal server produce low-severity intrusion events all day, and every alert is dismissed on its own. Their correlation policy's default priority is low. They want a single high-severity escalation that emails the on-call engineer the moment a matching event arrives from that server. Which correlation policy configuration should the team deploy?

The required configuration is a correlation rule scoped to intrusion events from the identified server, with high priority explicitly set and an email response attached. This turns matching events into a high-severity escalation and notifies the on-call engineer as soon as an event arrives; relying on the policy’s low default priority would not meet the severity requirement. A five-minute aggregation window can be useful for grouping bursts and reducing duplicate notifications, but it delays the escalation, so it does not satisfy the requirement to act immediately on arrival. Applying the rule to all internal servers preserves the priority, timing, and email behavior, but broadens the scope beyond the specific server and may generate unrelated alerts. Creating an incident ticket is a common response workflow, but it does not fulfill the explicit requirement to email the on-call engineer. Exam caveat: distinguish rule-level priority and response settings from policy defaults, and check whether aggregation or suppression introduces a delay. Practical check: test with a matching event from the target server and verify that one high-priority correlation alert and the expected email are produced immediately.