A municipal SOC is creating several weak risk rules for parks, courts, and permitting accounts. What should each rule include so a later risk notable automatically tells an ATT&CK story?
Select an answer to reveal the explanation.
Short Explanation
Annotations are the sticky notes on each little risk rule. When the pile becomes a notable, those notes already tell the ATT&CK story. Skip them and someone is hand-labeling tactics at 2 a.m.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, framework annotations on risk rules map each weak contributing detection to industry frameworks such as MITRE ATT&CK so that when parks, courts, and permitting risk events aggregate into a risk notable, the notable inherits the tactic and technique story automatically. Annotating each municipal risk rule at creation time is therefore what makes the later CIO-facing notable explainable without a midnight remapping exercise. Creating a unique custom index per department so annotations can be reconstructed from index names fails by concept because index names are not ATT&CK mappings and fragment the ES risk index model. Adding a dashboard XML panel that lists MITRE tactics only after the notable is closed fails by concept because post-closure documentation does not enrich the notable while analysts are working it. Relying on a SOAR playbook that writes ATT&CK IDs into a ticket comment when the CIO asks fails by concept because that is reactive ticket text, not inherited annotations on contributing risk events. Exam caveat: SPLK-5001 expects new civic risk rules to carry framework annotations so risk notables present the ATT&CK narrative without a separate mapping step. Operational check: open a parks or permitting risk rule, confirm ATT&CK annotations are set, generate or locate a risk notable that includes those contributing events, and verify the notable’s framework fields show the inherited tactics and techniques before briefing leadership.