County detections are tagged to Kill Chain stages so an analyst can see a notable is C2 rather than delivery. How should that tagging be understood?
Select an answer to reveal the explanation.
Short Explanation
Kill Chain is a pair of glasses, not a filing cabinet. Tagging a notable C2 instead of delivery tells the analyst where the attack sits. CIM still normalizes the fields; Kill Chain does not become an index or a lookup.
Full Explanation
The Lockheed Martin Cyber Kill Chain is used in Enterprise Security as an analytic framework: detections can be annotated so a notable is understood as C2 rather than delivery. CIM remains the schema that normalizes vendor fields into data models; Kill Chain does not replace it. It is not an index, a tstats-accelerated data model, or a substitute for Asset and Identity lookups.