Asset and Identity marks the elections voter-file server as high priority and a lab PC as low. How should Risk-Based Alerting treat those assets?
Select an answer to reveal the explanation.
Short Explanation
A voter-file server is the vault; a lab PC is the spare folding chair. Enterprise Security already stamped that priority in Asset and Identity, so Risk-Based Alerting should lean harder on the vault. Equal weights or ignoring A&I throw away the civic criticality the lookup just gave you.
Full Explanation
Splunk Enterprise Security operationalizes basic risk management by enriching assets and identities with priority. Risk-Based Alerting should apply a higher weight to a high-priority elections server than to a low-priority lab PC so equivalent activity produces a more urgent risk story on the critical asset. Scoring only by raw event volume, equalizing endpoints, or silencing elections assets defeats that enrichment.