An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?
It has to be D because host is for Splunk audit logs. dest, obviously not. src_nt_host is for network sessions (DHCP and VPN traffic), so by getting rid of all the options, must be D.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
supremesplunker
1 week, 6 days agonosavotor
3 months, 4 weeks ago