A risk notable for suspicious activity around the county treasurer shows a rising score. Which entity is the Risk Object that holds that score?
Select an answer to reveal the explanation.
Short Explanation
The score lives on the person or the box, not on the alarm's nickname. For the treasurer, the risk object is that identity (or the host if ES scored the system). The search name is just the rule that added points.
Full Explanation
In the ES risk framework, a risk object is typically a user or a system that accumulates score from risk-analysis actions. Analysts investigate that entity. The correlation-search name, a Security Posture tile, and data-model acceleration metadata do not hold the risk score. Distinguishing the scored entity from the detection that wrote the score is essential when reading a risk notable.