On a municipal SOC, who usually creates Enterprise Security annotations on a correlation search or risk rule, and who consumes them during triage?
Select an answer to reveal the explanation.
Short Explanation
Engineers pack the box; analysts read the label on the loading dock. Annotations are authored on the correlation search or risk rule and consumed on Incident Review—not typed in by the city attorney or stamped on syslog at ingest.
Full Explanation
On a municipal SOC, detection engineers (or content owners) attach Enterprise Security annotations when they author or tune a correlation search or risk rule, and analysts consume those labels during triage on Incident Review. That separation of duties keeps framework mappings consistent with the detection's intent: the people who understand what the search covers stamp CIS, NIST, and ATT&CK metadata; the people investigating the civic notable read the stamp to orient response. Annotations are therefore authored on content and consumed on notables—not improvised at ticket close.
Having night-shift analysts write annotations while closing tickets fails by role and timing: triage closes investigations; it does not redefine detection framework coverage, and engineers would lose a durable content record. Having the city attorney author annotations in the Asset and Identity lookup fails by both actor and store—legal counsel is not the content author, and asset/identity lookups are not the annotation surface. Having indexer admins stamp annotations onto raw syslog at ingest fails by layer: ingest and indexing handle data plumbing; framework annotations belong on ES security content, and dashboards should not hide them from analysts who need them.
Exam caveat: watch for options that move annotation authorship to attorneys, indexers, or closing analysts; the exam expects content-side creation and analyst-side consumption.
Operational check: in the municipal ES content app, open a correlation search, confirm annotations are set by the detection owner, generate a test notable, and verify the night-shift analyst sees those same labels on Incident Review without editing Asset and Identity or syslog props.