The city SOC still pages the on-call for every cheap signal—rare VPN, new mailbox rule, off-hours admin on the treasurer account. What RBA change should they make?
Select an answer to reveal the explanation.
Short Explanation
Stop pulling the fire alarm for every cheap chip—stack them. RBA lets rare VPN, mailbox rules, and off-hours admin add risk until the pile is worth a notable. Don't throw the detections away or hide them in a spreadsheet.
Full Explanation
Risk-Based Alerting should replace paging on every cheap treasurer signal: many weak civic indicators add risk to the identity, and only the aggregated high-fidelity risk notable pages the on-call. That reduces fatigue while preserving rare VPN, mailbox rule, and off-hours admin events as contributing evidence. Keeping a standalone notable and a page for every cheap signal fails by concept because it recreates noisy one-alert-per-signal operations that RBA is meant to fix in municipal SOCs. Disabling those detections because weak indicators are never useful fails by concept because weak signals remain useful in aggregate even when they should not page alone. Storing cheap signals only in a spreadsheet outside Enterprise Security fails by concept because off-platform tracking breaks risk scoring, auditability, and contributing-event reconstruction inside ES. Exam caveat: SPLK-5001 promotes RBA aggregation for high-fidelity alerting from multiple weak civic signals rather than per-signal pages or spreadsheet side channels. Operational check: convert cheap treasurer detections to risk-analysis Adaptive Response, set a sensible risk-notable threshold, verify contributing events tell the story, and page only on the aggregated notable.