A fire/EMS analyst finds a concerning firewall deny in Search that no correlation search has tracked. Is that event a notable?
Select an answer to reveal the explanation.
Short Explanation
A scary line in the log is evidence, not a case. Nothing is a notable until ES (or the analyst) actually creates one. Color in Search and CIM fields do not magically open a queue item.
Full Explanation
Notables exist only after the notable framework creates them—typically a correlation search's notable Adaptive Response or a manual/ad-hoc notable. Raw events in Search, including CIM-normalized firewall denies, are not notables by themselves. Privileged ports and highlighting do not change that. If monitoring missed the pattern, the analyst can create a notable manually rather than relabeling every interesting event.