From a courts notable, the analyst runs ad-hoc ping and nslookup. What job do those Adaptive Response actions do compared with a risk notable?
Select an answer to reveal the explanation.
Short Explanation
Ping is looking out the window, not the whole case. Ad-hoc AR enriches a notable; a risk notable is the piled-up suspicion. Don't confuse a name lookup with aggregated risk.
Full Explanation
Ad-hoc Adaptive Response actions such as ping and nslookup gather enrichment from an open notable. A risk notable is a thresholded aggregate of risk on a risk object. Enrichment does not create that aggregate, does not by itself justify a True Positive disposition, and is not the same ES object as a risk notable. Use each construct for its job.