A hunter needs each true match on a court-clerk detection to raise the identity's risk score without paging email. Which default-style Adaptive Response should be selected?

Default-style Enterprise Security Adaptive Responses include notable creation, risk analysis, email, ping, nbtstat, and nslookup, each with a distinct purpose in the civic SOC workflow. When each true match on a court-clerk detection should raise the identity's risk score without paging email, the correct selection is the risk analysis Adaptive Response so the detection writes risk to the court-clerk identity (or related risk object) rather than sending mail on every match. Risk-Based Alerting in a county ES deployment depends on that continuous score accumulation so clerks and related accounts surface when combined behaviors cross thresholds.

Send email makes the on-call inbox the risk register, creates alert fatigue, and still fails to accumulate score in the Risk framework that Risk-Based Alerting depends on. Ping the workstation only tests reachability; ICMP connectivity is not how Enterprise Security stores or aggregates risk. nbtstat resolves NetBIOS naming for enrichment during analysis and does not replace risk scoring on the court-clerk identity when the goal is continuous risk accumulation.

Exam caveat: know which stock Adaptive Response writes risk versus which enrich or notify—risk analysis is the action that feeds the Risk framework, while email and network enrichment serve different jobs. Operational check: on the court-clerk correlation search, enable risk analysis Adaptive Response targeting the identity fields used in Asset and Identity, disable unnecessary per-match email, generate a test true match, and verify the identity's risk score increases in Enterprise Security without an on-call email page.