A risk notable for a city finance user lists annotations from several contributing risk events, each mapping a different ATT&CK technique. What is the intended use of that stacked view?
Select an answer to reveal the explanation.
Short Explanation
Several sticky notes on one finance-user risk notable are the chapter titles, not a bug. Each contributing event brought its ATT&CK technique along, so the analyst can read the story — phish, then mailbox rule, then odd login — in one place. That stack is the point of annotations on risk notables.
Full Explanation
A risk notable for a city finance user lists annotations from several contributing risk events, each mapping a different ATT&CK technique. The intended use of that stacked view is a readable multi-technique story of the aggregated risk on that identity. Civic framing matters because finance users are high-value civic risk objects; seeing phish, mailbox-rule, and anomalous-login techniques together helps the analyst prioritize the next investigative pivot on one identity.
Treating the stack as proof that annotations are broken because only one technique is allowed fails by concept: risk notables are designed to aggregate multiple contributing events and their metadata. Deleting the risk notable to keep only hash lookups fails by concept: hashes alone miss identity-centric multi-stage stories that risk scoring is meant to surface. Claiming contributing events should not carry framework metadata fails by concept: annotations on contributing events are how the multi-technique narrative reaches Incident Review.
Exam caveat: SPLK-5001 risk-notable items expect multiple ATT&CK annotations on one risk object to be a feature—do not "fix" the stack by stripping metadata or falling back to hashes only.
Operational check: Open the city finance user's risk notable, walk each contributing event and its ATT&CK annotation in time order, pivot on the highest-priority technique in the story, and leave the stacked annotations intact as investigative context.