問題文
An analyst opens a single detection. Which set of facts should they expect it to establish?
選択肢
- Whether the activity was authorized by the organization change process, since the platform compares each operation against the approved change records.
- The full sequence of everything the identity did before and after, because a detection always carries the complete session history of the acting identity so that the analyst does not need to move to another page.
- The response action that should be taken, chosen by the platform according to the resource type involved and presented as a single next step to be carried out from the detection itself.
- Which rule matched, which resource the activity concerned, which identity performed it, and when it happened.