An analyst investigates an alert about unusual data transfers and determines it was an authorized backup job, not an incident. What should the analyst do next?
Select an answer to reveal the explanation.
Short Explanation
"Nothing to see here" still deserves a note in the logbook. Writing down what you checked and why you closed it protects you if questions come up later and helps tune future alerts. Deleting the record is the trap; you'd lose the evidence that you looked at all.
Full Explanation
Not every event becomes an incident, but every investigated event should leave a record. Documenting what was examined, the evidence considered and the reason for the determination provides accountability, supports later review if related activity emerges, and gives data for tuning detection rules, for example recognizing authorized backup jobs. The event is then closed according to the defined procedure, which may include feedback to the monitoring team. Deleting the alert record removes the audit trail, prevents trend analysis and leaves no evidence that the alert was investigated if the determination is later questioned. Escalating a routine non-incident to senior management misuses the escalation path, wastes executive attention and undermines the value of escalation for real incidents. Keeping the event open as a potential incident for an arbitrary period distorts incident metrics and the workload picture, and the procedure for reopening a closed event if new evidence appears serves that need better. Exam caveat: if similar false positives recur, the documentation should feed a tuning request so that analysts are not repeatedly investigating the same authorized activity. Operational check: confirm the closed event record contains the analyst, the evidence reviewed, the determination and the closure reason.