An analyst has noticed unusual activities in the SIEM to a .cn domain name. Which of the following should the analyst use to identify the content of the traffic?

Log review examines previously recorded events and does not actively capture or analyze the DNS-level content of live traffic to a suspicious domain.

Service discovery identifies open ports and running services on network hosts but does not analyze DNS traffic patterns or domain infrastructure.

Packet capture records raw network traffic for deep content inspection but is a broader technique, whereas DNS harvesting specifically targets domain-level intelligence needed to characterize suspicious domain activity.

DNS harvesting collects and correlates DNS query records to map the full set of hostnames, subdomains, and IP addresses associated with a suspicious domain, revealing the scope and nature of communications between internal hosts and the target. When an analyst identifies unusual SIEM activity to a .cn domain, DNS harvesting provides intelligence about what infrastructure that domain resolves to and which internal hosts are communicating with it. This technique uncovers domain-level communication patterns and relationships that contextualize the suspicious traffic.