An AI triage tool summarizes a Windows authentication alert, ranks it high risk, and recommends escalation. The analyst sees the event came from a backup service account during a scheduled job, with no matching EDR process or NetFlow. What is the best analyst action?
Select an answer to reveal the explanation.
Short Explanation
Think of the AI as a very fast junior analyst: it can point at the messy pile, but you still check the facts. If you let a risk score close or escalate tickets by itself, you've swapped one blind spot for a shinier one. Use the model's summary as a lead, then prove it with logs, EDR, and business context.
Full Explanation
AI-assisted triage is most useful when it compresses large alert volumes into ranked leads, not when it replaces human adjudication. A model may infer elevated risk from statistical anomaly, but the analyst must correlate the artifact with authentication context, process lineage, endpoint telemetry, and scheduled operations before escalation or closure. This preserves the intended SOC control: automation reduces noise while human review prevents false positives and false negatives from becoming incident actions. Treating an automated escalation recommendation as final authority is incorrect because ranking is probabilistic and lacks organizational context, such as maintenance windows or privileged service behavior. Suppressing solely because a summary omits a framework mapping is also wrong; absence of a named technique does not prove benign activity, and the analyst should still verify the event against known behavior. Closing based only on a confidence threshold is unsafe because model confidence is not equivalent to exploitability, business impact, or completeness of evidence. Exam caveat: CS0-004 expects AI to augment triage and hunting, not to make unsupervised incident decisions. Operational check: require every AI-ranked alert to be validated against at least one independent telemetry source, such as EDR process trees or NetFlow, before its disposition is finalized.