問題文
Grouping by rule shows that a single rule produced 80 percent of the matches for the week, all from many different resources and identities. What is the most likely reading?
選択肢
- The rule is working exactly as intended, because a rule that produces many matches is covering more of the environment than a rule that produces few, and coverage is what the detection program is trying to maximize.
- That rule is probably matching ordinary activity in this environment, so its conditions should be examined before the matches are treated as work.
- The other rules must have stopped evaluating, because in a healthy environment the matches are distributed evenly across the enabled rules and a concentration points at a failure in the evaluation of the remaining ones.
- A widespread attack is under way, because activity affecting many resources at once can only be the work of an attacker with broad access, so the volume itself settles what the matches mean.