The county architect publishes a detection-coverage heatmap against ATT&CK and a data-onboarding roadmap. A night-shift analyst treats that as a prompt to redesign CIM mappings before clearing the queue. What is the correct hand-off among the three SOC roles?
Select an answer to reveal the explanation.
Short Explanation
The heatmap is the city plan, CIM is the plumbing, and the queue is tonight's calls. Architects draw coverage; Engineers hook up the data; Analysts work whatever fires. Redesigning CIM mid-shift is the wrong hat.
Full Explanation
Coverage strategy and a data-onboarding roadmap are Architect work. Implementing CIM mappings and detection content against that roadmap is Engineer work. Operational use — tonight's Incident Review queue — is Analyst work. Reversing those hand-offs mixes the roles; the correct sequence is strategy, then implementation, then consume-and-triage.