On a municipal SOC, who usually creates Enterprise Security annotat…

Question

On a municipal SOC, who usually creates Enterprise Security annotations on a correlation search or risk rule, and who consumes them during triage?

Accepted Answer

Detection engineers attach annotations on the content; analysts read those labels on Incident Review — Engineers pack the box; analysts read the label on the loading dock. Annotations are authored on the correlation search or risk rule and consumed on Incident Review—not typed in by the city attorney or stamped on syslog at ingest.

Answer

Night-shift analysts write the annotations while closing tickets, and engineers never see them

Answer

The city attorney authors annotations in the Asset and Identity lookup, and SOAR consumes them

Answer

Indexer admins stamp annotations onto raw syslog at ingest, and dashboards hide them from analysts

On a municipal SOC, who usually creates Enterprise Security annotations on a correlation search or risk rule, and who consumes them during triage?

Short Explanation

Full Explanation