The city SOC still pages the on-call for every cheap signal—rare VPN, new mailbox rule, off-hours admin on the treasurer account. What RBA change should they make?
Select an answer to reveal the explanation.
Short Explanation
Stop pulling the fire alarm for every cheap chip—stack them. RBA lets rare VPN, mailbox rules, and off-hours admin add risk until the pile is worth a notable. Don't throw the detections away or hide them in a spreadsheet.
Full Explanation
Risk-Based Alerting aggregates low-fidelity signals onto a risk object so a high-fidelity Risk Notable fires at threshold instead of paging on each weak indicator. Disabling the detections discards useful contributing evidence. External spreadsheets and per-signal notables recreate the noisy on-call queue RBA is designed to replace. Analysts should expect many risk rules and few risk notables.