City water utilities keeps getting noisy correlation searches after a new historian was onboarded. Someone must tune the search, fix CIM mappings, and adjust risk scores. Which role should leadership assign?
Select an answer to reveal the explanation.
Short Explanation
Noisy detections after a new historian is like a smoke alarm that screams every time the boiler kicks on — someone has to retune the alarm, not just acknowledge it all night. That retune, CIM fix, and risk-score work is Engineer content work. The on-shift analyst still consumes whatever fires.
Full Explanation
After a city water utility onboards a new historian and correlation searches become noisy, leadership should assign a SOC Engineer. Detection content ownership—tuning the search, correcting CIM mappings so the new sourcetype normalizes, and adjusting risk scores—is content engineering, not queue triage. Civic OT telemetry still lands in Enterprise Security the same way: someone must fix the plumbing so Analysts are not drowning in false positives about plant process noise.
Handing the work to the on-shift SOC Analyst fails by concept: Analysts dispose of notables; rebuilding searches and CIM is not their core duty even when the queue is painful. Assigning the SOC Architect fails by concept: Architects set coverage and standards strategy; they do not implement field-by-field CIM fixes as the primary response. Assigning the plant operator fails by concept: OT operators own plant process safety and historian operations, not Enterprise Security content engineering.
Exam caveat: Noise after onboarding is a data-and-detection engineering problem first; do not confuse who feels the pain in the queue with who owns the fix in content.
Operational check: Ticket the Engineer with the new sourcetype, expected CIM models, sample noisy notables, and target risk thresholds; verify after the change that historian events normalize and false-positive rate drops before returning the queue to normal Analyst staffing.