County detections are tagged to Kill Chain stages so an analyst can see a notable is C2 rather than delivery. How should that tagging be understood?
Select an answer to reveal the explanation.
Short Explanation
Kill Chain is a pair of glasses, not a filing cabinet. Tagging a notable C2 instead of delivery tells the analyst where the attack sits. CIM still normalizes the fields; Kill Chain does not become an index or a lookup.
Full Explanation
When county detections are tagged to Kill Chain stages so an analyst can see a notable is C2 rather than delivery, that tagging is an analytic and annotation lens on Enterprise Security content—not a replacement for CIM. Kill Chain language helps civic Analysts reason about intrusion progression while CIM continues to normalize fields for searching and data models. Framework lenses and normalization schemas solve different problems and coexist.
Treating Kill Chain as a CIM data model that accelerates with tstats fails by concept: Kill Chain is not a Splunk CIM model. Treating Kill Chain as an ES index that stores C2 packets fails by concept: it is not a packet store or index name. Claiming Kill Chain replaces Asset and Identity lookups fails by concept: asset and identity context remains a separate ES capability from stage annotations.
Exam caveat: Frameworks (Kill Chain, ATT&CK, Diamond) annotate or structure analysis; CIM normalizes data—do not swap those categories on the exam.
Operational check: Keep Kill Chain or ATT&CK annotations on detections for analyst storytelling, keep CIM mappings for field normalization, and document both in the county content standard so new searches always receive the right metadata without inventing fake indexes.