The county treasurer account collected several cheap risk events—rare VPN, a new mailbox rule, off-hours admin—without paging the on-call. A queue item appears only after the aggregated score crosses the city's threshold. What fired?
Select an answer to reveal the explanation.
Short Explanation
One cheap chip does not cash out the table—the pile does. Risk notables wait until the treasurer's score crosses the city's line. That is aggregated suspicion, not a page for every VPN quirk.
Full Explanation
A Risk Notable fires when aggregated risk on a risk object crosses a configured threshold rather than paging on every cheap indicator. Several low-weight events on the county treasurer—rare VPN, a new mailbox rule, off-hours admin—accumulate until the city's threshold produces the queue item without waking on-call for each chip. Claiming a standalone notable for the first cheap VPN indicator fails by concept when RBA is designed so individual cheap hits write risk instead of always creating notables and pages. Claiming every risk event automatically becomes a raw syslog notable fails by concept because risk events contribute score to a risk object; they are not each promoted to a notable by default. Claiming an Adaptive Response ping replaced the risk score fails by concept because ping is enrichment during analysis, not the risk-aggregation mechanism that creates risk notables. Exam caveat: SPLK-5001 emphasizes Risk-Based Alerting where many weak civic signals become one higher-fidelity risk notable for the on-call. Operational check: open the treasurer risk notable, expand contributing events to see the cheap hits and timestamps, confirm threshold logic with engineering, and avoid re-enabling per-signal pages for those weak indicators without a documented exception.