A 911/PSAP SOC runbook says the on-duty analyst may run an ad-hoc Adaptive Response ping from a notable but may not edit that correlation search's scheduled trigger. What does that rule correctly bound?
Select an answer to reveal the explanation.
Short Explanation
An ad-hoc ping is using the radio; editing the scheduled search is rewriting the dispatch rules. Analysts can run Adaptive Response from a notable and set status or disposition. They do not own the correlation search's clock.
Full Explanation
Analysts operate within a notable: they assign status and disposition and may invoke ad-hoc Adaptive Response actions such as ping. Changing a correlation search's scheduled trigger is detection-content ownership and sits with Engineer or admin-adjacent roles. An ad-hoc action does not rewrite program architecture. Giving on-shift analysts the scheduled search would mix consume-and-triage with content engineering and is the bound the runbook is preventing.