A risk notable for suspicious activity around the county treasurer shows a rising score. Which entity is the Risk Object that holds that score?

In the Enterprise Security risk framework, a risk object is typically a user or a system that accumulates score from risk-analysis Adaptive Responses. Analysts investigate that entity—the treasurer identity or the historian host—not the nickname of the detection that wrote points. Treating the correlation-search title in Content Management as the risk object fails by concept because the search is content that emits risk; it does not hold the score as the investigated entity on the notable. Treating the Security Posture dashboard tile that graphs civic urgency as the risk object fails by concept because Posture summarizes domains and urgency for briefings; it is not the scored identity or host. Treating the CIM datamodel acceleration checksum for Authentication as the risk object fails by concept because acceleration metadata is unrelated to risk scoring entities and does not explain a rising treasurer score. Exam caveat: SPLK-5001 requires distinguishing the scored risk object from the correlation search and from overview dashboards when reading a risk notable. Operational check: open the risk notable, identify whether the risk object type is user or system, expand contributing events for that object, and brief finance on the entity's scored story—not on the search title or Posture tile.