問題文
In a risk contribution, the engineer sets the entity to a hostname and the entity type to system. What does the type declaration control?
選択肢
- Whether the contribution is written as an intermediate finding or as a finding, because system-type entities go directly to the analyst queue while user-type entities accumulate first over a longer period.
- Which detections are allowed to aggregate the contribution, because a finding-based detection can only read contributions of a single declared type at a time in a single search run.
- How much the score is multiplied before it is written, because machines and accounts carry different inherent weights in the risk framework, which the type value selects.
- Which table the value is expected to correspond to and therefore how the value is interpreted and displayed alongside other risk for the same kind of thing, keeping machine risk and account risk in separate buckets in the report.