The county architect publishes a detection-coverage heatmap against ATT&CK and a data-onboarding roadmap. A night-shift analyst treats that as a prompt to redesign CIM mappings before clearing the queue. What is the correct hand-off among the three SOC roles?
Select an answer to reveal the explanation.
Short Explanation
The heatmap is the city plan, CIM is the plumbing, and the queue is tonight's calls. Architects draw coverage; Engineers hook up the data; Analysts work whatever fires. Redesigning CIM mid-shift is the wrong hat.
Full Explanation
The correct hand-off is Architect sets coverage strategy (heatmap and data-onboarding roadmap), Engineer implements CIM and detection content against that strategy, and Analyst uses the resulting detections on tonight's queue. County heatmaps and roadmaps are planning artifacts; CIM plumbing and content are implementation; clearing notables is shift operations. Civic SOCs break when the night shift tries to redesign normalization instead of working incidents.
Having the Analyst redesign CIM tonight while the Engineer owns the heatmap and the Architect clears the queue fails by concept: it inverts all three roles. Having the Architect implement CIM while the Engineer triages and the Analyst publishes the roadmap fails by concept: Architects do not own field-level CIM implementation as primary work, Engineers do not own the live queue as primary work, and Analysts do not own multi-year roadmaps. Having the Engineer set three-year strategy while the Analyst implements CIM and the Architect works the queue fails by concept for the same role-boundary reasons.
Exam caveat: When a stem shows an Analyst "treating" an architecture artifact as a prompt to redesign content mid-shift, the answer restores Architect → Engineer → Analyst sequencing.
Operational check: Route heatmap gaps to Architect backlog, create Engineer stories for CIM and detections, and keep Analyst runbooks focused on triage using the currently enabled content—not ad-hoc schema redesign during the shift.