A city attorney asks what a courthouse notable actually means. The analyst has the correlation-search SPL and an annotation whose tactic name is Credential Access. Which language should the analyst use in the briefing?
Select an answer to reveal the explanation.
Short Explanation
The attorney does not want a soup of eval statements—they want the plot. Annotation tactic names like Credential Access are the plain-language chapter titles ES already printed on the notable.
Full Explanation
A core purpose of Enterprise Security annotations is to translate detection content into industry framework language that non-operators can follow. Tactic and technique labels on the notable are the right briefing vocabulary; raw SPL is how the search works, not how to explain the finding. Indexer topology and Adaptive Response ping results do not replace that framework story. Analysts consume the annotation on Incident Review and reuse it with civic stakeholders.