A SIEM alert shows a cloud virtual machine making repeated outbound connections to an external IP address and domain. Analysts cannot tell whether these are known command-and-control servers or a legitimate partner service, so triage takes hours. Which capability would most directly speed up this decision?

Threat intelligence enrichment matches indicators in alerts, such as external IP addresses, domains, file hashes and URLs, against curated feeds and adds context like reputation scores, known association with command-and-control infrastructure, related campaigns and first-seen dates. Integrated into the SIEM or SOAR workflow, it turns an unexplained connection into a triaged event in seconds, letting analysts quickly decide whether to escalate or close. A honeypot is a deception control that lures attackers and gathers their techniques; it does not reveal whether this particular destination is malicious and adds a new asset to manage. An authenticated vulnerability scan reports missing patches and misconfigurations on the host, which may explain how it was compromised later but says nothing about the reputation of the remote endpoint. Longer log retention helps reconstruct history, yet reviewing more connections to an unknown address still leaves analysts without the external context they need. Exam caveat: intelligence quality varies, so feeds should be evaluated for relevance, timeliness and false positive rates, and enrichment informs rather than replaces analyst judgment. Operational check: confirm that alerts containing external indicators display reputation and source attribution automatically, and track triage time before and after.