At a manufacturer, the plant has an alert that a signature fired on one flow, and no packets were saved for that flow. What can that alert not answer?
Select an answer to reveal the explanation.
Short Explanation
A fire alarm tells you that it rang, not what the smoke looked like. You can learn that a detector judged the flow, the signature name, and the time, but not the payload bytes when no packets were saved. The trap is expecting the alert to contain the content it only judged.
Full Explanation
An alert records a detector's judgment. It can say that a rule matched, it can carry the signature name, and it can carry the time of that decision. It does not store the payload unless a separate capture was kept, and this plant saved no packets. The question the alert cannot answer is What the payload bytes inside the matching flow actually contained at the time. That content lived in the packets, and those packets were not retained. That a detector judged the flow and raised this signature alert on the plant host is what an alert is for, so the alert can answer it. The signature name the detector attached at the moment the alert fired is part of the judgment record and does not require the payload. The clock time recorded when the detector stored its judgment on the alert is also part of the alert and does not require the bytes. Exam caveat: alert data and the original packets answer different questions, and a signature name is not a reconstruction of the payload. Operational check: read the alert for the verdict, the signature name, and the time, and do not claim the payload bytes are known from those fields alone.