問題文
The team wants related findings about the same compromised laptop to be presented together rather than as separate entries in the queue. What is the purpose of grouping them, and what does the engineer choose when configuring it?
選択肢
- The purpose is to raise the urgency of the whole set to the highest member's urgency; the engineer chooses whether the group inherits the highest or the average urgency of its members, which the setting controls for the group.
- The purpose is to reduce the number of rows written to the index; the engineer chooses a retention period after which the group and all its member findings are removed.
- The purpose is to give the analyst one contextual picture instead of several fragments; the engineer chooses which values define one group and how far back related activity may be pulled in when the group is built.
- The purpose is to let one analyst own several findings at once; the engineer chooses which analyst receives each group so ownership is assigned before the group appears in the queue.