A county analyst finds an elections clerk mailbox-forwarding pattern that no correlation search turned into a notable. What Enterprise Security action should the analyst take so the event is tracked in the queue?
Select an answer to reveal the explanation.
Short Explanation
Not every civic oddity has a search watching it yet. When the mailbox-forwarding trail is real, the analyst can still plant a notable by hand so the queue owns the case. Do not wait for a search that does not exist.
Full Explanation
Enterprise Security allows analysts to create ad-hoc notables or findings from interesting events that scheduled correlation searches missed. That object then appears on Incident Review / Analyst Queue with status, owner, and disposition like any other notable. Waiting for a threshold, leaving ES, or writing a SOAR playbook is not required to start tracking. Manual notable creation is in-scope analyst use of ES.