問題文
A detection engineer is configuring a risk analysis response action. Which statements about what gets recorded and what it is used for are correct? (Select two.)
選択肢
- The recorded entries replace the raw events, so the original events can be aged out of the index sooner and the SOC can reduce its retention costs without losing the ability to investigate the behaviors that produced each score.
- Each recorded entry names the object the risk is attributed to, so scores accumulate per asset or per identity rather than globally.
- Each recorded entry immediately appears in the analyst queue with an urgency derived from its score.
- Entries can be annotated with framework mappings, so the accumulation can be evaluated not only by total score but also by how many distinct tactics were observed.
- A risk factor that multiplies the score for privileged accounts creates its own entry in the analyst queue so that the analyst knows the multiplier was applied.