The mayor's office wants a three-year plan for how the municipal SOC will cover MITRE ATT&CK, which data sources to buy, and how Enterprise Security plus SOAR will mature. Which role owns that plan?
Select an answer to reveal the explanation.
Short Explanation
A three-year ATT&CK-and-buy-data plan is city planning, not tonight's ticket. Architects draw the map for coverage, sources, and how ES plus SOAR should grow. Analysts work the queue; engineers implement content on that map.
Full Explanation
SOC Architects own program design: ATT&CK coverage strategy, which telemetry to acquire, and how Enterprise Security and SOAR mature over years. Engineers implement detections and data onboarding against that roadmap. Analysts use annotated notables during a shift; seeing a technique on a notable does not make them the author of the three-year plan. An investigation, even a major incident, is still an operational case, not platform-maturity architecture.