問題文
A detection engineer at a utility company adds MITRE ATT&CK technique identifiers to the Annotations section of 40 correlation searches. What does the engineer gain from this work, stated in terms of what an analyst or a manager can now do?
選択肢
- The correlation searches appear in the use case library under the framework filter without further work, and the analysts can then browse the SOC's own detections beside the shipped content.
- The alerts are automatically assigned a higher urgency when the annotated technique is one that the framework marks as high impact, so the queue reorders itself once the mapping is saved.
- The correlation searches begin to run against the accelerated data models associated with each technique, and that reduces the time each search takes and therefore lets the engineer schedule all 40 of them in the same window.
- Alerts arrive carrying the framework mapping as labeled fields, and the coverage across the framework can be summarized to show which parts of it no detection touches.