A city firewall shows 10.20.30.40 contacting a rare destination at 02:00, and the SOC must name the laptop and the staff identity that held that address. What should the analyst combine?
Select an answer to reveal the explanation.
Short Explanation
An overnight IP is a locker number, not a nametag. DHCP says which laptop rented the locker, DNS helps confirm the name, and the firewall proves the session. No single civic log usually carries all three.
Full Explanation
Binding an IP observed on the network to a host and a user is a multi-source reconstruction: DHCP leases map IP to client identifier or hostname, DNS records corroborate names, and firewall or Network_Traffic sessions confirm the connection at that time. A single source rarely holds IP, hostname, and identity together in municipal environments. Badge or DLP data may add context later, but they do not replace the IP-to-host-to-user join. Combining those three sources is the useful-data-source skill for this investigation.