The city set the risk-notable threshold so low that Incident Review looks like the old one-alert-per-signal queue. What RBA adjustment should the SOC make first?
Select an answer to reveal the explanation.
Short Explanation
If the fire bell rings for every match, the bell is set too sensitive. Turn the risk-notable threshold up so only a real pile of civic chips opens a ticket. Do not throw the RBA stack in the trash.
Full Explanation
Risk notables fire when aggregated score on a risk object exceeds a configured threshold. A threshold that is too low recreates the noisy notable queue that RBA is designed to replace. Tuning that threshold is an essential RBA practice and is how a municipal SOC controls volume without abandoning contributing events. Zeroing all scores or reverting to notable-only searches discards the aggregation model instead of calibrating it.