The elections file server is marked critical in the Asset lookup. A malware notable fires on that host. How should urgency be handled?
Select an answer to reveal the explanation.
Short Explanation
Priority lives on the asset record, and ES uses that tag to crank up the notable's urgency—like a red sticker on the elections file cabinet. There is no special priority index to invent. High-value civic boxes should get louder tickets automatically.
Full Explanation
When the elections file server is marked critical in the Asset lookup and a malware notable fires on that host, Enterprise Security should apply the asset's Asset and Identity priority so the notable's urgency rises automatically. That is the designed path for civic critical assets: asset priority informs urgency without inventing a separate priority index or waiting for an email from an elections clerk before taking the finding seriously.
Creating a separate priority index and moving the server's events into it confuses indexing strategy with Asset and Identity urgency inheritance on notables. Ignoring Asset and Identity priority and raising urgency only if the elections clerk emails the SOC replaces automation with unreliable human notification. Deleting the notable because elections hosts must not generate findings hides real risk on the highest-value civic systems and defeats monitoring.
Exam caveat: critical assets raise urgency via Asset and Identity priority on the notable—do not delete elections findings or invent priority indexes as workarounds.
Operational check: confirm the elections file server asset record has critical priority and owner, fire or replay a malware notable for that host, and verify Incident Review urgency reflects the elevated asset priority before briefing elections leadership.