A county just deployed a SOAR platform next to Enterprise Security. The first hunt for unusual treasurer-account logons still needs a primary data source. What should the analyst pick?
Select an answer to reveal the explanation.
Short Explanation
SOAR is the dispatch radio, not the 911 recording. The hunt still starts in the logs ES already has. Playbook audits and case comments will not be the treasurer's logon sourcetype.
Full Explanation
SOAR is an analysis and response system that orchestrates actions from Enterprise Security; it is not the primary telemetry source for a first hunt. Unusual treasurer logons live in authentication data already indexed for ES, typically the Authentication data model or Windows Security. Playbook audits, asset inventories, and case comments record automation and ticketing, not the original DC events. Keep SOAR out of the sourcetype choice for the hunt.