The CIO asks why a utilities clerk now has a risk notable. What must the civic RBA stack provide so the analyst can explain the notable without guessing?
Select an answer to reveal the explanation.
Short Explanation
A good risk notable is a story, not a mystery novel. Contributing events are the chapters: rare VPN, mailbox rule, off-hours admin. If the analyst cannot walk the CIO through those chips, the stack is not finished.
Full Explanation
A well-built RBA design uses many risk rules to write contributing events and only a few risk notables when aggregated score crosses a threshold. Those contributing events are what make the notable explainable to leadership. A lone notable-only search, a raw-log dump, or admin XML does not give the analyst a readable civic risk story. SPLK-5001 expects the analyst to require that explainability.