The true power of RBA is the Risk Incident Rule. This is a special correlation search that monitors the total risk score of all objects.
When an object's accumulated score crosses a defined threshold (e.g., > 100) within a time window (e.g., 24 hours), it generates a single high-fidelity Risk Notable.