A city feeds automated enrichments into both the SOC SIEM and the regional fusion center portal. What integration pattern is that?

A city that feeds automated enrichments into both the SOC SIEM and the regional fusion center portal is integrating defensive automation outputs across municipal SOC and fusion workflows. One enrichment pipeline, two consumers: SOC analysts keep machine-readable fields in the SIEM, and fusion partners see the same context in their portal without depending on screenshots or tribal knowledge. That pattern reduces duplicate research and improves regional situational awareness for civic incidents that cross bureau or jurisdiction lines.

Why the other options fail by concept: Forwarding enriched SIEM detections into the municipal fusion portal workflow sends enriched context only to the fusion workflow and does not keep that same automation output in the SOC SIEM for analysts, so it misses the one-pipeline-to-both-systems integration the question describes. Synchronizing SOC case management tickets with fusion center request workflows ties enrichment delivery to ticket workflows rather than pushing automated context to both systems, and it does not put enrichment data into the SIEM and portal as described. Replicating regional fusion center intelligence bulletins into the municipal SOC SIEM runs the flow backward, brings fusion content into the SOC instead of sending SOC enrichments to the fusion portal, and leaves the fusion portal without the city's defensive automation output.

Exam caveat: Cross-system integration must still enforce least privilege and data-handling rules—fusion may receive enriched alert context without receiving raw evidence packages that require separate custody controls. Operational check: generate an enriched test alert and confirm identical key fields appear in the SOC SIEM and the fusion portal within the expected sync window, with access logs showing appropriate municipal roles only.