The same authorised partner transfer alerts every month. What do you record instead of an allowlist entry?
answer
- quiet is not the same as cheap
- keep the human, remove the rework
- an expiry date or it lives forever
- narrow scope makes deviation visible
- a mismatch is a better lead than the alert
basics
~20 sRecord the authorised activity, not a suppression: who owns it, the exact combination permitted, the evidence that authorises it, and an expiry or review date. The alert keeps firing and keeps being reviewed - it just resolves in minutes.
solid answer
~40 sAn allowlist entry stops the alert from being seen; a recurring-authorised-activity record stops it from being *expensive*. The record names the owner who can confirm the activity, the precise shape authorised - this records group, this partner tenant, this sanctioned client, this rough volume, this contract reference - and a date when it expires. The next analyst opens the alert, checks the fields still match the record, and closes it a benign true positive in two minutes. What survives is the thing suppression destroys: someone still looks. If the volume triples, the destination shifts to a tenant not in the contract, or the account is one nobody added to the records group, the mismatch is visible - which is how an adversary hiding inside an approved workflow gets caught.
go deeper
Know that repeated authorised activity should be written down as expected, and that silencing an alert is not the same as resolving it. Be able to say why review is worth keeping.
Explain the fields a usable expected-activity record needs - owner, exact scope, evidence, expiry - and how the next analyst uses it to reach a fast benign true positive verdict.
Demonstrate the tradeoff: tight scope costs review time and buys visibility of deviation. Show how a mismatch against the record becomes a stronger lead than the original detection produced.
Own the position that accepted blindness must be an explicit, time-boxed, named decision, and that letting triage convenience create permanent exclusions quietly transfers risk with nobody accountable for it.
## The pressure and the wrong answer A correct detection that fires on the same authorised activity every month is a real cost: an analyst spends forty minutes reconstructing a conclusion someone already reached. The reflex is to make it stop - an allowlist entry, a suppression on the account, an exclusion for the sanctioned sync client, a threshold moved above the observed volume. Every one of those buys quiet by removing review. The rule may still evaluate, but nothing reaches a human, and the estate now has a documented, discoverable shape of activity that nobody looks at. That shape is precisely what an adversary wants: an approved path, a trusted client, a known destination. Suppression turns your best-scoped detection into a hole with an audit trail explaining where it is. ## What to write instead A **recurring-authorised-activity record** (organisations call it an expected-activity register, a known-good register, a documented exception) sits next to the detection, not inside it. A usable one carries: - **The owner.** A named person or role who can confirm the activity is still authorised, and who can be asked. Not a team mailbox nobody reads. - **The exact scope.** The combination that is authorised, stated in the fields the analyst can see: this group of accounts, this destination tenant, this client, this content classification, this approximate volume and cadence. Narrow beats broad - the point is that a deviation is visible. - **The evidence.** The contract, ticket or approval reference, and who confirmed it and when. Without this the record is folklore. - **An expiry or review date.** Contracts end, projects finish, people leave. An entry with no expiry becomes permanent by neglect, which is how suppressions outlive their justification by years. - **What is *not* covered.** Explicitly: a different destination, a different account, a materially different volume, a different client. This is the clause that turns the record into a triage aid rather than a blanket excuse. ## How this changes the triage The alert still fires and still lands in the queue. The analyst's job changes from *investigate from scratch* to *test the match*: do the observed fields fall inside the recorded scope, and is the record still in date? If yes, close **benign true positive** with a pointer to the record and the fields compared. Minutes, not an hour, and the case note is stronger than most first-time investigations because the comparison is explicit. If the answer is no - the destination is a tenant not named in the contract, the volume is ten times the recorded cadence, the account is a developer rather than a records user - the analyst has something better than a fresh alert. They have a **deviation from an authorised baseline**, which is a far sharper lead than the original rule ever produced. ## The judgment calls - **Scope tightly, even though it costs review time.** A record covering "any transfer by the records team" resolves more alerts and detects nothing. A record covering that team to that tenant with that client leaves the mismatches visible. - **Expire aggressively.** Prefer a short expiry with a cheap renewal to a long one nobody revisits. The renewal conversation is where you learn the contract ended in April. - **Distinguish the two remedies.** The recurring record answers "this is expected here"; a change to the rule itself answers "this rule misreads data". A benign true positive is evidence for the first and no evidence at all for the second, so do not let repetition become an argument that the logic is broken. - **Suppression is not always wrong, but it needs a much higher bar.** If you genuinely accept blindness to a shape of activity, that acceptance should be an explicit, owned, time-boxed decision with someone's name on it - not a filter an analyst added at 03:00 to clear a queue. ## The failure to name in an interview The worst outcome is the undocumented tribal answer: analysts individually learn to close these fast because "it is just the records team again". Nothing is written, nothing expires, nothing is checkable, and the first transfer that does not fit the pattern gets closed exactly as fast as the ones that did.
- How would you make an entry expire in practice rather than in principle?Give every entry a date beyond which the triage aid is simply not valid, so an analyst hitting an expired record has to re-verify with the owner. Tie renewal to the underlying authorisation - the contract end date, the project close - rather than a generic annual sweep, and make an unrenewed entry fail loudly rather than quietly persisting.
- When is a real suppression the right call?When the organisation is knowingly accepting blindness to a specific, narrow shape of activity and someone senior is willing to own that acceptance with a scope and an end date. It should be a deliberate, recorded risk decision, not a triage convenience, and it should never be applied to a broad, adversary-attractive path like a sanctioned sync client.
- The activity recurs but the volume doubled this month. How do you treat it?As outside the recorded scope, which means it is an open case again rather than a fast benign closure. Re-verify with the owner: has the contract expanded, or is a legitimate workflow being used to move more than anyone approved? The value of a tightly scoped record is that this question gets asked instead of being absorbed.
A guard who is told to ignore the delivery van sees nothing when someone else drives it. A guard who is told which van, which driver, which gate and which hours still waves it through in seconds - and notices the day one of those is different.
saying these in an interview costs you the question
- Adds an allowlist entry so the alert stops appearing
- Excludes the sanctioned client from the rule to reduce volume
- Writes an exception with no owner and no expiry date
- Scopes the record broadly to catch every variation
- Relies on analysts remembering that this one is always fine