A municipal SOC is creating several weak risk rules for parks, courts, and permitting accounts. What should each rule include so a later risk notable automatically tells an ATT&CK story?
Select an answer to reveal the explanation.
Short Explanation
Annotations are the sticky notes on each little risk rule. When the pile becomes a notable, those notes already tell the ATT&CK story. Skip them and someone is hand-labeling tactics at 2 a.m.
Full Explanation
Enterprise Security annotations map detections and risk rules to industry frameworks, especially MITRE ATT&CK. When contributing risk events carry annotations, the resulting risk notable can present the tactic and technique story without a separate mapping exercise. Creating RBA content without annotations wastes that framework work and leaves the CIO-facing notable unexplained. Analysts should insist new civic risk rules include annotations at creation time.