A security analyst at a retail firm must prove whether one suspicious internal host triggered only connections or also attack signatures and malicious files during the same hour. FMC already logs every event type for that segment. Which view or report should the analyst open to put that host's connection, intrusion and malware records on one timeline?

The unified events view can display connection, intrusion, file and malware records together in a time-ordered table. Filter on the host address and the relevant hour to review its records across those event types in sequence. This lets you compare a session that carried a download, an intrusion signature that fired during the same period, and the file verdict that followed without changing screens. The connection events view answers session questions such as allow or drop decisions, ports, protocols and byte counts, but it does not show the intrusion signature or malware record needed for this comparison. The intrusion events view is useful for ranking detections by priority, yet it does not place the related sessions or file evidence alongside the signature hits. The malware events view lists file verdicts, disposition changes and the receiving host, but omits the connection and intrusion records that help explain how the file arrived and what signatures fired. An exam caveat is that a unified timeline helps correlate records but does not, by itself, prove that one event caused another. As a practical check, set the time range first, filter on the host address, and confirm that connection, intrusion and malware records all appear before drawing a conclusion.