The city set the risk-notable threshold so low that Incident Review looks like the old one-alert-per-signal queue. What RBA adjustment should the SOC make first?

In Splunk Enterprise Security for a municipal SOC, risk notables open on Incident Review when aggregated score on a risk object exceeds a configured threshold. If that threshold is set so low that every weak civic chip opens a queue item, the city has recreated the old one-alert-per-signal flood and defeated the purpose of Risk-Based Alerting. The first adjustment is to raise the risk-notable threshold so only meaningfully aggregated civic risk opens a queue item while contributing events continue to write. Deleting the risk index and returning every correlation search to notable-only adaptive responses fails by concept because it abandons aggregation entirely instead of calibrating volume. Lowering every individual risk-rule score to zero so nothing can ever cross a threshold fails by concept because it disables detection rather than tuning the gate between risk events and notables. Moving threshold configuration into a new raw syslog index that analysts scan manually fails by concept because thresholds live in the RBA/ES configuration, not in a side index. Exam caveat: SPLK-5001 treats threshold tuning as core RBA practice for municipal queue hygiene—raise the bar for notables without throwing away contributing events. Operational check: document current threshold and daily risk-notable volume, raise the threshold in a controlled change, compare Incident Review volume and false-positive rate for utilities and finance risk objects over several days, and confirm weak signals still appear as contributing events under the risk object.