An emergency-operations status page publicly discloses the model family used by the city's crisis assistant. What should threat intelligence do with that indicator?
Select an answer to reveal the explanation.
Short Explanation
A public model-family hint is like a weather radio chirp—file it, keep listening for storms that match that gear. Don't just send it to the SOC for a block rule and close the ticket; you still need continuous monitoring for advisories and chatter.
Full Explanation
When an emergency-operations status page publicly discloses the model family used by the city’s crisis assistant, threat intelligence should file that detail as an AI threat-intel indicator and continuously watch for related vendor advisories, CVE-class issues, and exploit-technique chatter applicable to that stack. Public technical fingerprints are free signal: they help prioritize patching, detection content, and tabletop scenarios for emergency messaging AI without requiring invasive probing. Continuous monitoring converts a one-time status-page observation into ongoing defensive awareness for a high-impact civic system.
Recording it only in the centralized asset inventory and reviewing vendor release notes during quarterly audits falls short: the model family is an active AI threat-intel indicator that needs continuous advisory and exploit-chatter monitoring, not passive lifecycle tracking on a quarterly schedule. Forwarding the model family to the SOC for signature-based blocking and closing the intel action after opening a ticket fails because it treats a stack fingerprint as a static blocklist entry and ends monitoring too early, missing ongoing advisories and exploit chatter. Publishing the indicator with detailed deployment context in a public feed fails because it exposes sensitive operational details about a civic emergency system, potentially aiding adversaries instead of enabling controlled defensive monitoring.
Exam caveat: Public model/stack disclosure items usually reward “collect indicator + monitor advisories,” not premature SOC blocking with case closure or public feed publication of deployment details. Distinguish intelligence use from unauthorized destructive response.
Operational check: add model-family and vendor tags to the crisis-assistant asset record; subscribe or watch relevant advisories; map detection use-cases; and ensure any model replacement follows change control with emergency-operations stakeholders informed—not premature signature-based blocking and case closure without continuous monitoring.