A county SOC is adding a correlation search for a weak civic signal: a treasurer VPN from a rare city. Leadership wants fewer single-signal pages to on-call. How should that search's adaptive responses be designed?
Select an answer to reveal the explanation.
Short Explanation
A single rare-city VPN is a faint smoke smell, not a fire alarm. Risk analysis drops a chip on the treasurer's pile; a notable is the bell that should wait until the pile is actually tall. One weak civic ping should feed the risk index, not page the night shift.
Full Explanation
Risk-Based Alerting in Enterprise Security uses correlation searches whose adaptive response is risk analysis so weak indicators become contributing events on a risk object. A notable-only search for the same cheap civic signal recreates the noisy queue RBA is meant to shrink. Strong detections and risk notables that fire after aggregated score still belong in Incident Review. Defense analysts should request risk-as-action for low-fidelity signals rather than a standalone notable per match.