A wastewater notable is noisy, but its annotation shows ATT&CK Execution. How should the hunter use that annotation next?
Select an answer to reveal the explanation.
Short Explanation
The annotation is a trail marker, not a volume knob. If the notable says Execution, the next civic hunt step is often Persistence—not deleting the label, wiping historians, or swapping in an old hash.
Full Explanation
When a wastewater notable is noisy but its annotation shows ATT&CK Execution, the hunter should treat that label as a map of adversary progress and pivot toward a likely follow-on tactic such as Persistence, Privilege Escalation, or Command and Control—not as a volume knob. Technique and tactic annotations orient hypothesis-driven hunting: even when the firing rate is high, the framework stamp tells the civic hunter which chapter of the attack story the detection believes it saw, so the next searches look for what usually comes next on OT/historian-adjacent hosts.
Deleting the annotation so the notable stops appearing fails by concept: removing metadata does not fix noisy logic or missing allowlists, and it destroys hunt guidance. Converting the annotation into a SOAR playbook that wipes every historian without further search fails by leaping from a tactic label to destructive automation—Adaptive Response and playbooks need scoping, evidence, and change control, not a blind wipe. Replacing the annotation with last year's encryptor hash fails by dropping durable technique context for a perishable IoC; hashes guide enrichment, they do not replace ATT&CK-directed hunting.
Exam caveat: noisy ≠ useless. SPLK-5001 expects hunters to use annotations as directional cues while separately tuning false positives—not to erase labels or automate destructive response from a tactic name alone.
Operational check: keep the Execution annotation, note which wastewater hosts and users appear on the notable, run follow-on hunts for Persistence artifacts (new services, scheduled tasks, autoruns) on those assets, and open a content ticket to tune the noisy correlation search without stripping its framework metadata.