An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network…

The correct answer is A. Endpoint. Endpoint is correct because the Endpoint data model captures host-level telemetry including process activity, and process-to-network correlation requires knowing which process on the host initiated the connection - data that lives in endpoint sources like Sysmon, EDR agents, or…

Incident Investigation and Response

Question

An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network connection?

Options

AEndpoint
BAuthentication
CNetwork traffic
DWeb

How the community answered

(31 responses)

A
84% (26)
B
10% (3)
C
3% (1)
D
3% (1)

Explanation

Endpoint is correct because the Endpoint data model captures host-level telemetry including process activity, and process-to-network correlation requires knowing which process on the host initiated the connection - data that lives in endpoint sources like Sysmon, EDR agents, or OS audit logs.

Network Traffic (C) only shows the connection itself (IPs, ports, bytes) without process context, so you can confirm the suspicious destination but not the responsible process. Authentication (B) covers login events and credential use - unrelated to process-network mapping. Web (D) focuses on HTTP/proxy traffic and URLs, not OS-level process behavior.

Memory tip: Think "who did it?" - Endpoint answers which process (the actor on the host), while Network Traffic answers what happened (the connection). When the question involves process-level attribution, go Endpoint.

Topics

#Endpoint data model#process correlation#network connections#Enterprise Security

Community Discussion

No community discussion yet for this question.

Full SPLK-5001 Practice