When creating a detection, how might an engineer ensure that all possible contextual fields about a given asset and identity are added to a risk event?

Question

Options

• AUse | lookup identities.csv to call all available identity information in the detection output.
• BInclude the standard CIM fields (e.g. user, src, src_user, etc.) in the detection output.
• CCall an adaptive response action for Active Directory using | ldapsearch for a real-time update.
• DUse | lookup assets.csv to call all available asset information in the detection output.

• A
  5% (1)
• B
  73% (16)
• C
  14% (3)
• D
  9% (2)

Explanation

To ensure all possible contextual fields about an asset and identity are included in a risk event, the engineer should include the standard CIM fields (such as user, src, src_user, etc.) in the detection output. These fields are recognized by the Assets & Identities framework and automatically enrich risk events with relevant context.

No community discussion yet for this question.