The municipal VPN detection for a logon from a rare city is too cheap to page the on-call by itself. How should that hit become part of a later risk notable?
Select an answer to reveal the explanation.
Short Explanation
Don't pull the fire alarm for one odd VPN—stamp a chip on the account instead. Risk-analysis AR writes that cheap hit to the risk object so it can add up later. That is how a rare-city logon becomes a contributing event, not a 2 a.m. page.
Full Explanation
The risk-analysis Adaptive Response writes a risk event to the risk index against a risk object. Weak indicators such as VPN from a rare geolocation are intended to contribute score rather than generate standalone notables. Emailing leadership, paging from Security Posture on every CIM field, or forcing Protocol Intelligence to notable every VPN logon recreates the noisy queue Risk-Based Alerting is meant to replace.