A 911/PSAP SOC runbook says the on-duty analyst may run an ad-hoc Adaptive Response ping from a notable but may not edit that correlation search's scheduled trigger. What does that rule correctly bound?
Select an answer to reveal the explanation.
Short Explanation
An ad-hoc ping is using the radio; editing the scheduled search is rewriting the dispatch rules. Analysts can run Adaptive Response from a notable and set status or disposition. They do not own the correlation search's clock.
Full Explanation
A 911/PSAP runbook that lets the on-duty analyst run an ad-hoc Adaptive Response ping from a notable but forbids editing that correlation search's scheduled trigger correctly bounds Analyst versus Engineer authority. Analysts may take contained response actions and set status or disposition; scheduled detection ownership—when and how the search fires—stays with Engineer content roles. That boundary protects public-safety detection integrity while still giving responders useful tools during a live case.
Requiring Analysts to edit every correlation search before they can ping fails by concept: ad-hoc Adaptive Response is meant to be usable from the notable without rewriting detection ownership. Making Adaptive Response ping Architect-only fails by concept: a ping does not change the three-year program plan and is an operational response action. Giving scheduled triggers to the on-duty Analyst so they can silence the queue fails by concept: silencing by rewriting schedules conflates triage with content control and creates untracked detection drift.
Exam caveat: Distinguish ad-hoc Adaptive Response and disposition (Analyst) from scheduled search and correlation-search ownership (Engineer).
Operational check: Encode in the PSAP runbook which Adaptive Response actions Analysts may invoke, require Engineer change control for schedule or search logic edits, and audit who modified correlation searches after noisy nights.