While mapping a municipal open-data RAG portal, the SOC discovers architecture notes, vendor names, and corpus descriptions in public documentation. What is the most appropriate recon use of that material?
Select an answer to reveal the explanation.
Short Explanation
Public docs are like a city map taped in the library window—anyone can read the streets. Use that map to build out your attack-surface picture, not to tinker with the retriever you're testing or hand the notes off as resident-facing guidance.
Full Explanation
While mapping a municipal open-data RAG portal, architecture notes, vendor names, and corpus descriptions found in public documentation are legitimate OSINT inputs for authorized AI reconnaissance. The most appropriate use is to enrich the civic AI attack-surface and pipeline intelligence map: identify indexes, ingestion paths, trust boundaries between public corpora and internal tools, and vendor-specific configuration classes that warrant monitoring. Public materials accelerate accurate inventory without violating RoE when used for defensive mapping rather than resident harm.
Ingesting corpus descriptions into the staging retriever to benchmark citizen answer relevance improvements turns a recon finding into an unauthorized change to the RAG pipeline itself—recon documents what's there, it doesn't modify the retriever under test. Escalating vendor names to procurement to verify support contracts and renewal dates is a legitimate vendor-management task, but it's an administrative follow-up, not a reconnaissance use of the material during the assessment. Forwarding architecture notes to the service desk to draft resident portal usage guidance repurposes technical recon findings into end-user documentation, which skips the actual goal of mapping attack surface and leaves the intelligence un-recorded.
Exam caveat: Distinguishing OSINT enrichment from administrative or operational side-tasks is common. When stems mention public docs about RAG architecture, choose “enrich the attack-surface map,” not staging changes, procurement escalation, or repurposing the notes as end-user guidance.
Operational check: add vendor, corpus, and pipeline nodes to the municipal AI inventory; note which indexes are truly public versus internally augmented; and schedule controls review (ingestion validation, access boundaries, monitoring) while leaving approved open documentation intact.