問題文
A hospital network runs a SOC with three tiers. Over the past month, one detection has produced 400 alerts and every one of them turned out to be a scheduled backup agent reading many files at once. The team agrees the search logic itself needs a new exclusion for the backup service account. In a SOC organized with separate analyst, engineer, and architect duties, whose work is it to change that search logic, and what does the analyst contribute?
選択肢
- The security engineer edits the detection search, and the analyst supplies the evidence from the triaged alerts that shows which account and behavior are producing the noise.
- Nobody changes the search logic; the analyst applies a suppression so the alerts stop appearing.
- The security architect edits the detection search, since search logic is part of the content design that the architect owns.
- The analyst edits the detection search directly, since the analyst is the person who saw the noise and therefore knows which exclusion the queue needs.