Context

• ES 8+ now allows notables (Findings) to have risk data associated with them
• We have TTP detections which generate both risks and notables, so we want to ensure risk data is only being associated with risks in this case to avoid risk score doubling
• We also have Correlation detections which generate notables alone (often based on an aggregation of existing risk entities); as of now, we don't define any risk modifiers for these, so we wouldn't expect them to be associated w/ risk data
• It's possible that ESCU's behavior in the future may change, but as of now, we do not expect ESCU detections to generate notables which appear in the risk data model

Code changes

• Added new methods to CorrelationSearch class which retrieves events from the risk data model
• During notable validation, risk data model is checked to ensure no notables appear in there
• New base class added to support notable and risk events

Testing

• TODO

TODOs

• disable logging
• address outstanding in-line TODOs