A 311 security ops desk receives only high-severity enriched tickets while low noise stays in the SIEM. What routing pattern is that?

A 311 security ops desk that receives only high-severity enriched tickets while low noise stays in the SIEM is using severity-based routing into civic work queues. 311 and similar municipal desks exist to handle actionable constituent-facing or high-impact security work, not every informational heartbeat. Keeping low-severity noise in the SIEM preserves detection coverage for analysts who live there, while enriched high-severity tickets reach the desk with enough context to act.

Why the other options fail by concept: Round-robin distribution that cycles high-severity enriched tickets to civic work queues in turn describes fair-share allocation of already-filtered tickets, not the severity filter itself, so it cannot explain why low noise stays in the SIEM while only high-severity enriched tickets enter civic work queues. Chronology-based routing that sends high-severity enriched tickets into civic work queues by arrival describes sequencing by arrival time, not filtering by impact, so it cannot explain why low noise stays in the SIEM. District-based routing that sends high-severity enriched tickets into civic work queues by district describes allocation by geography, not filtering by impact, so it cannot explain why low noise stays in the SIEM.

Exam caveat: Routing depends on trustworthy severity and enrichment; mis-severity high-impact incidents as low will leave them stranded in the SIEM away from the 311 desk. Operational check: inject informational and high-severity enriched test alerts, confirm only the high-severity ticket appears in the 311 work queue, and verify the informational alert remains searchable in the SIEM, proving severity filtering rather than cycling high-severity enriched tickets to civic work queues in turn.