After a library ransomware scare, leadership asks who should write a new "suspicious SMB spike" correlation search and who should work the first notable it creates. How should those duties be split?
Select an answer to reveal the explanation.
Short Explanation
Writing the smoke detector and answering when it beeps are two jobs. Engineers author the correlation search; Analysts take the first notable it drops on Incident Review. Architects are not the night-shift queue, and app admin is not detection authorship.
Full Explanation
Detection authorship — creating and maintaining a correlation search — is Engineer content work. First-line handling of the notable that search produces is Analyst work. Architects set coverage strategy; they do not write a single SMB search or triage its first firing as their primary task. Owning Enterprise Security as an administrator is not the same as either authoring detections or consuming them.