A court SOC adds ATT&CK annotations to a correlation search that has not matched in months. Staff expect a notable because the annotation is present. What is the correct scope of annotations?
Select an answer to reveal the explanation.
Short Explanation
Sticking a MITRE label on a silent search is labeling an empty mailbox. Annotations describe the detection; they do not ring the bell — a notable still needs the correlation search to match, sticky note or not.
Full Explanation
A court SOC adds ATT&CK annotations to a correlation search that has not matched in months. Staff expect a notable because the annotation is present. The correct scope is that annotations are metadata only; a search still has to match before a notable is created. Civic framing matters because court SOCs may equate framework labeling with alerting; empty mailboxes stay empty even with MITRE stickers unless events match thresholds and data are present.
Treating annotations as notables that always fire Incident Review fails by concept: annotations do not generate alerts by themselves. Claiming annotations replace CIM data models as the alerting engine fails by concept: CIM supports normalized searching; annotations do not supersede data models or become the detection engine. Calling annotations Adaptive Response actions that quarantine endpoints fails by concept: adaptive response takes action; annotations only carry framework metadata.
Exam caveat: SPLK-5001 annotation questions stress metadata versus detection—presence of ATT&CK IDs never substitutes for a matching correlation or risk rule.
Operational check: Verify the court correlation search is enabled, check data model and raw data freshness, review thresholds and filters for the silent months, and explain to staff that adding annotations will not create a notable without matches.