A court SOC adds ATT&CK annotations to a correlation search that has not matched in months. Staff expect a notable because the annotation is present. What is the correct scope of annotations?
Select an answer to reveal the explanation.
Short Explanation
Sticking a MITRE label on a silent search is labeling an empty mailbox. Annotations describe the detection; they do not ring the bell — a notable still needs the correlation search to match, sticky note or not.
Full Explanation
Enterprise Security annotations do not generate notables. A correlation search (or risk rule) must still match events before Incident Review receives an alert. Treating an annotation as an alert, as a CIM replacement, or as an Adaptive Response quarantine confuses metadata with detection and response. Court SOC analysts should verify search status, data, and thresholds when nothing fires, not add framework IDs and expect a notable.