The Enterprise Security Risk Framework enables detection engineers to express suspicious observations as risk against meaningful entities—typically users, systems, or other risk objects—and then prioritize those observations according to their security significance. Option C therefore represents the principal value being tested: prioritizing findings based on potential business impact .

In a Risk-Based Alerting design, an individual behavior does not necessarily need to generate an analyst-facing finding immediately. Instead, detections can generate risk events containing fields such as the risk object, risk object type, risk score, and contextual annotations. Multiple risk events can accumulate until correlation logic determines that the combined evidence warrants escalation. Risk Factors and asset/identity context can further modify significance when an affected entity is particularly sensitive or critical.

Risk processing is therefore fundamentally about contextual prioritization and evidence aggregation , not search-performance acceleration. It does not inherently create a threat-intelligence feedback loop, nor is its primary purpose to simplify SOAR execution. Those capabilities can interact with risk-based detections but are separate functions.

Study Guide topics: Enterprise Security Risk Framework; Risk-Based Alerting; risk objects; risk scores; business impact; security finding prioritization.