問題文
An engineer fills in the description field of a new detection. Who reads that text and when, and what should therefore go into it?
選択肢
- Analysts read it in the queue when triaging, so it should contain the first three steps of the investigation and the escalation contact that nothing else in the finding provides, which the triage step depends on in practice.
- Auditors read it during a compliance review, so it should reference the control identifier and the regulation that requires the detection to exist and the reviewer copies both of them into the audit workbook.
- Nobody reads it in practice, so it exists only to satisfy the required field validation and any placeholder text is acceptable, which is why most teams fill it with the requesting ticket number.
- Other engineers read it when reviewing or tuning the detection, so it should state what the logic looks for and which use case it addresses, rather than repeating the search string or duplicating the analyst-facing text on the finding.