After ransomware on a courthouse file server was missed, an analyst wants to stamp last week's notables with a new ATT&CK annotation so the gap looks covered. Why will that not fix the miss?

Annotations describe existing Enterprise Security content—they explain which frameworks a correlation search or risk rule is intended to cover. After ransomware on a courthouse file server was missed, stamping last week's notables with a new ATT&CK technique ID does not create coverage when no search matched and the required telemetry was never collected. Labels do not summon missing events, invent a detection that never fired, or rewrite history in the risk index. The civic miss is a data-onboarding or content-gap problem; the annotation only documents what the detection already claims to cover.

Assuming annotations automatically backfill missing risk-index events fails by treating metadata as an ingest pipeline—they do not reconstruct absent file-server logs. Believing that adding an annotation re-runs every historical correlation search against the courthouse sourcetype confuses content labeling with scheduled search execution and backfill jobs. Claiming annotations replace CIM mapping so the attack appears on Security Domain dashboards without a search collapses two different layers: CIM normalizes fields for searches; annotations tag framework intent. Neither substitutes for a matching detection.

Exam caveat: when a stem says the attack was missed, do not pick any option that implies a label alone regenerates notables or telemetry; coverage requires data plus a search that matches.

Operational check: inventory whether courthouse file-server logs (process, file, authentication) are onboarded and CIM-compliant, confirm a ransomware-relevant correlation or risk rule exists and is enabled, then validate with a controlled lab event that a notable fires—only then attach ATT&CK annotations that honestly describe that content.