A civic engineer asks the analyst what an Enterprise Security correlation search actually is before they request a new detection. Which definition should the analyst use?
Select an answer to reveal the explanation.
Short Explanation
A correlation search is a scheduled detector with a trigger and an action, not a one-off search typed at lunch. Notable, risk, email, SOAR—those ARs fire when the trigger hits. Dashboards and Python classes are other products.
Full Explanation
In Enterprise Security, a correlation search is a scheduled search that evaluates trigger conditions and then runs Adaptive Response actions—commonly create notable, risk analysis, email, or send to SOAR. Ad-hoc SPL is investigation, not a correlation search. Dashboard styling and SOAR playbook code are outside that definition. Analysts need this moving-parts picture to request the right detection without becoming ES administrators.