A county SOC is adding a correlation search for a weak civic signal: a treasurer VPN from a rare city. Leadership wants fewer single-signal pages to on-call. How should that search's adaptive responses be designed?

In Splunk Enterprise Security for a municipal SOC, Risk-Based Alerting treats a single weak civic signal—such as a treasurer VPN from a rare city—as a contributing event rather than an immediate Incident Review ticket. Designing that correlation search with only a risk-analysis adaptive response writes the match to the risk index against the treasurer as a risk object, so on-call pages stay reserved for strong detections or aggregated risk notables after score crosses threshold. Creating a notable on every rare-city VPN match fails by concept because it recreates the one-alert-per-signal queue RBA is meant to shrink and trains leadership to ignore pages. Disabling the correlation search and asking the treasurer to self-report unusual travel fails by concept because human email is lagging, incomplete, and not continuous telemetry on indexed VPN events. Forwarding every rare-city VPN syslog line to a new custom index for hand query fails by concept because it abandons ES adaptive responses and risk aggregation for a siloed hunt pile. Exam caveat: SPLK-5001 expects defense analysts to request risk-as-action for low-fidelity civic signals and to keep notables for high-fidelity or aggregated findings, not to invent side indexes or self-report workflows. Operational check: open the correlation search’s adaptive responses, confirm Risk Analysis is the action for the rare-city VPN rule, verify risk events appear on the treasurer risk object without a new notable per match, and show leadership that Incident Review volume dropped while contributing evidence still accumulates.