An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which…

Question

Options

• Ahost
• Bdest
• Csrc_nt_host
• Dsrc_ip

• A
  4% (2)
• B
  16% (7)
• C
  7% (3)
• D
  73% (33)

Explanation

In Splunk's Common Information Model (CIM), src_ip maps specifically to the IP address of the source host - the system from which a connection or activity originates. In a lateral movement scenario, the attacker is pivoting from one host to another, making the originating machine the source, so src_ip is the correct field.

Why the distractors are wrong:

• A. host - This is a Splunk metadata field that identifies which forwarder/device sent the log to Splunk, not a CIM network field representing an attacker's IP.
• B. dest - This represents the destination IP, i.e., the host the attacker is moving to, which is the opposite of what the question asks.
• C. src_nt_host - This is the source host's NetBIOS/Windows hostname (a name string), not an IP address - the question specifically asks for an IP address field.

Memory tip: Think "src = source = sender = the one initiating." Since lateral movement goes from attacker to victim machine, the attacker's machine is the source. CIM consistently uses src_ip for the originating IP and dest_ip/dest for the target - if the question asks for an IP (not a hostname), rule out src_nt_host immediately.

No community discussion yet for this question.