The county treasurer account collected several cheap risk events—rare VPN, a new mailbox rule, off-hours admin—without paging the on-call. A queue item appears only after the aggregated score crosses the city's threshold. What fired?
Select an answer to reveal the explanation.
Short Explanation
One cheap chip does not cash out the table—the pile does. Risk notables wait until the treasurer's score crosses the city's line. That is aggregated suspicion, not a page for every VPN quirk.
Full Explanation
Risk-Based Alerting writes risk to a risk object; a Risk Notable is generated when aggregated risk on that object exceeds a configured threshold. Individual cheap indicators are contributing events, not automatically notables. Treating the first VPN hit as a standalone notable, assuming every syslog line is a notable, or substituting a ping adaptive response misstates how risk notables are created.