問題文
A quarterly review finds a detection that has produced zero findings in six months. What is the correct way to reason about it?
選択肢
- Merge it with a detection that covers the same MITRE technique, because two detections carrying the same annotation are redundant by definition and one of them can be removed from the app.
- Determine whether the behavior it looks for is absent, or whether the data it depends on stopped arriving, because those two situations look identical from the count alone and call for opposite actions from the engineer.
- Disable it, because a detection with no findings in six months is by definition not contributing to coverage and consumes scheduler capacity that the detections which do produce findings need in order to run on time on the same search head.
- Lower its threshold until it produces findings, because a detection that never fires cannot be validated and an unvalidated detection cannot be trusted in the production queue.