A risk notable fired on the treasurer identity. The analyst needs to explain why the score exists before briefing finance. What should they expand?
Select an answer to reveal the explanation.
Short Explanation
Think itemized receipt under the total. Contributing events are the cheap hits that added up on the treasurer. The cluster map and the license graph will not explain the score to finance.
Full Explanation
Contributing events—also called intermediate findings or risk events—are the individual scored items that explain a risk notable. Expanding them lets the analyst reconstruct the story (rare VPN, mailbox rule, off-hours admin) for stakeholders. Indexer topology and license usage are operational views, not the risk story, and stripping annotations from raw syslog discards the scored trail ES already built.