After a permitting-portal incident, the city restored service, documented the case, and closed the notable. What should the SOC still confirm about continuous monitoring?
Select an answer to reveal the explanation.
Short Explanation
The portal is back online, so point the cameras at the hole the attacker used—a new sourcetype or correlation search, whatever was missing. Closing the notable without feeding those lessons into monitoring is how the same trick works next month.
Full Explanation
After recover, continuous monitoring should resume with the gap closed: onboard the missing sourcetype, add or tune a correlation search, or otherwise watch the path that allowed the permitting-portal incident. Disabling detections to empty the queue, freezing content for a year, or returning to a quarterly spreadsheet undoes that loop. Lessons from the fifth investigation stage belong back in the scheduled searches and dashboards that feed the next identify stage.