After ransomware on a courthouse file server was missed, an analyst…

Question

After ransomware on a courthouse file server was missed, an analyst wants to stamp last week's notables with a new ATT&CK annotation so the gap looks covered. Why will that not fix the miss?

Accepted Answer

Annotations describe existing detection content; they do not create coverage when no search matched and no data was collected — Putting a new label on an empty box does not put a gift inside. Annotations describe detections that already exist—they do not summon missing data or a search that never fired.

Answer

Annotations automatically backfill missing events from the risk index as soon as a technique ID is added

Answer

Adding an annotation after the fact re-runs every historical correlation search against the courthouse sourcetype

Answer

Annotations replace CIM mapping, so the missed attack will appear on Security Domain dashboards without a search

After ransomware on a courthouse file server was missed, an analyst wants to stamp last week's notables with a new ATT&CK annotation so the gap looks covered. Why will that not fix the miss?

Short Explanation

Full Explanation