問題文
A detection returns results in which the acting user appears in the user field and the target machine appears in the dest field. The engineer wants the resulting findings to be ranked higher when they involve a machine that the organization has marked as business critical. How is that achieved?
選択肢
- Add a case expression to the detection search that sets the severity to critical whenever the dest field matches one of the critical machines, since the search is the only place the machine list is in scope and the list has to be edited there whenever a machine is added.
- Set the detection's investigation type to a value that carries a higher weight, because the investigation type determines where the finding appears in the ordering of the analyst queue view.
- Add the machine name to the throttle configuration's fields to group by, so findings involving that machine are kept separate from the others and therefore rise to the top of the queue, which the grouping fields decide.
- Populate the asset framework with a priority for that machine and make the lookup automatic, so results are enriched at search time and the priority combines with the detection's severity to produce the urgency, because both inputs are then in scope.