A transit analyst says notables and Adaptive Response are mutually exclusive, so a correlation search that creates a notable is not using AR. What is the correct relationship?
Select an answer to reveal the explanation.
Short Explanation
Filing the case is itself a response action. In ES, create-notable is a standard Adaptive Response on the correlation search. Notable and AR are teammates, not rival products.
Full Explanation
A common Adaptive Response on a correlation search is to create a notable. Treating notable and Adaptive Response as mutually exclusive is a term error: the notable is often the output of an AR. Ping and nslookup are other ARs, not the only ones, and dashboard XML is not how analysts replace that framework.