A transit detection engineer attaches MITRE ATT&CK technique IDs to a correlation search. What are those attachments, and why do they matter on Incident Review?
Select an answer to reveal the explanation.
Short Explanation
Those MITRE IDs are sticky notes on the detection, not the siren and not the quarantine button. Annotations ride along with the notable so the transit analyst can see why the search exists. They do not isolate VLANs or replace the search.
Full Explanation
A transit detection engineer attaches MITRE ATT&CK technique IDs to a correlation search. Those attachments are annotations: framework metadata that travel with the notable so the analyst sees why the detection exists. Civic framing matters because transit SOCs need Incident Review to show analytic rationale for rail and radio-adjacent detections without confusing metadata with response actions or the alerting engine itself.
Calling them adaptive response actions that isolate the train-radio VLAN fails by concept: adaptive response executes an action; annotations only describe framework mapping. Calling them risk objects that replace the correlation search fails by concept: risk objects are entities that accumulate risk scores, and they do not replace the search that generates notables. Calling them threat-intelligence hashes that fire notables by themselves fails by concept: threat-intel hashes are indicators for matching; they do not fire notables alone, and annotations are not hashes.
Exam caveat: SPLK-5001 expects annotations = framework metadata on detections/notables—do not confuse them with adaptive response, risk objects, or self-firing threat intel.
Operational check: On Incident Review for the transit notable, read the ATT&CK annotations to understand coverage intent, confirm the correlation search—not the annotation—produced the alert, and keep VLAN isolation under adaptive response only when that action is configured.