An elections risk story shows scores on both the elections clerk (user) and the elections workstation (system). How should the analyst treat those risk objects?
Select an answer to reveal the explanation.
Short Explanation
Two named suspects, two lines of inquiry. ES scored the clerk and the workstation for a reason. Merging them into elections buries which entity actually did what.
Full Explanation
When Enterprise Security scores both the elections clerk as a user risk object and the elections workstation as a system risk object, the analyst should investigate those objects separately. Each can accumulate different contributing events and need different containment—account controls versus endpoint isolation. Collapsing them into one object named elections because they share a story fails by concept because merging buries which entity crossed threshold and which remediation applies to identity versus host. Investigating only the user while treating system scores as merely informational fails by concept because host-based persistence, malware, or local abuse may live primarily on the workstation risk object. Investigating only the host while treating user scores as duplicates fails by concept because credential theft, mailbox rules, and cloud identity behaviors attach to the clerk identity and would be missed. Exam caveat: SPLK-5001 expects separate handling of user and system risk objects when both are scored in a civic incident. Operational check: open both objects' contributing events, document identity versus host findings in the case, and remediate account controls and endpoint containment as distinct, tracked workstreams.