A security analyst must give an auditor a list of every discovered host on the claims-floor VLAN that still runs a legacy operating system before the segment is rebuilt next quarter. Threat Defense discovery has been running for six months and active scanning is off limits. Which FMC view should the analyst open?
Select an answer to reveal the explanation.
Short Explanation
The host profile is built from what Threat Defense actually watched on the wire, so the detected system sits right there on the page. You get a direct answer instead of piecing one together from event logs. It's like reading the label on the box rather than guessing what shipped inside.
Full Explanation
The host profile is the management center's per-endpoint record, and the operating system it shows comes from passive network discovery: Threat Defense watches service replies, traffic patterns and timing on the wire and attributes a detected system to the address. Because discovery has been running for months, opening each profile from the network map gives you a direct, host-by-host list you can hand to an auditor. The executive summary risk report rolls risk up at the environment level, so it tells you how exposed the business is rather than which boxes run an old system. The intrusion event report shows which exploits were attempted, which helps spot attacks but never proves what a host is actually running. Exporting connection events and grouping by port 445 is an inference from service usage, and plenty of healthy hosts will trip that filter. Exam caveat: detection is passive, so quiet or heavily filtered hosts can come back with an unknown or thin profile. Practical check: spot-check two or three profiles against known build records before publishing the list.