City water utilities keeps getting noisy correlation searches after a new historian was onboarded. Someone must tune the search, fix CIM mappings, and adjust risk scores. Which role should leadership assign?
Select an answer to reveal the explanation.
Short Explanation
Noisy detections after a new historian is like a smoke alarm that screams every time the boiler kicks on — someone has to retune the alarm, not just acknowledge it all night. That retune, CIM fix, and risk-score work is Engineer content work. The on-shift analyst still consumes whatever fires.
Full Explanation
SOC Engineers own detection content: they tune correlation searches, correct CIM mappings so the new sourcetype normalizes, and adjust risk scores so alerting matches the environment. Analysts triage and dispose of the notables those searches create; they do not rebuild the content as their core job. Architects set coverage strategy; they do not implement CIM field by field. OT operators run the plant, not Enterprise Security content.