An elections risk story shows scores on both the elections clerk (user) and the elections workstation (system). How should the analyst treat those risk objects?
Select an answer to reveal the explanation.
Short Explanation
Two named suspects, two lines of inquiry. ES scored the clerk and the workstation for a reason. Merging them into elections buries which entity actually did what.
Full Explanation
Risk objects are typically users or systems. A single investigation can involve more than one scored object, and each should be scoped on its own (account activity versus host process and network). Collapsing user and host into a single informal object, or ignoring one type, can miss persistence on the workstation or account-takeover on the clerk. SPLK-5001 expects analysts to follow each scored entity.