A correlation search emails the on-call analyst for every parking-meter result, and 5,000 meters flap overnight. What Adaptive Response configuration change is needed?
Select an answer to reveal the explanation.
Short Explanation
Five thousand flapping meters will drown the on-call phone if every result sends mail. Raise the trigger threshold so Adaptive Response fires when the pile is real. Per-event email is a pager that never sleeps.
Full Explanation
Adaptive Response must be bounded with trigger conditions so civic scale does not turn response into noise. When a correlation search emails the on-call analyst for every parking-meter result and 5,000 meters flap overnight, the needed change is to raise the trigger threshold or otherwise bound Adaptive Response—by result count, throttling, or time window—so email does not fire on every flapping result. Leaving the trigger at every result so no meter event is missed guarantees inbox collapse and trains analysts to ignore meter mail. Disabling all Adaptive Response because meters cannot be in a SIEM throws away a valid detection source instead of fixing the trigger. Moving the search to index=* so more events create more emails widens the flood and worsens the misconfiguration. Exam caveat: AR trigger thresholds and throttling are part of correct ES detection design at municipal scale—especially for high-cardinality IoT or meter estates. Operational check: set a higher result threshold or throttle on the parking-meter correlation search's email AR, replay overnight flap volume in a test window, and confirm on-call email volume drops to actionable bursts while notables or risk still capture the condition if required.