Which of the following accurately describes an individual notable event?

Question

Options

• AIt can be cloned.
• BIt is immutable.
• CIt can have its status changed
• DIt can be assigned to an analyst.

• B
  89% (25)
• C
  7% (2)
• D
  4% (1)

Explanation

An individual notable event is a discrete, read-only record of a security occurrence - once created by the system, its underlying data cannot be altered, which is the defining characteristic of immutability (B). This immutability is foundational to security operations because it preserves the integrity of the audit trail and ensures forensic validity.

Why the distractors are wrong:

• A (cloning): Events are generated by the system from log/telemetry data; cloning is not an operation that applies to individual events - it may apply to detection rules or playbooks, not the events themselves.
• C (status change): Status changes (e.g., New → In Progress → Closed) apply to cases, incidents, or investigations that aggregate events - not to the individual event record itself.
• D (assigned to analyst): Similarly, assignment to an analyst is a workflow action performed on cases or incidents, not on raw individual events.

Memory tip: Think of a notable event like a photograph of a crime scene - you can put it in a folder (case), hand the folder to a detective (assign), and mark the folder as solved (status) - but you cannot alter the photograph itself. The photo is immutable.

No community discussion yet for this question.