The city mail gateway quarantined an unknown attachment on a permitting clerk's message. Which analysis tool should the SOC use to learn what the file does?
Select an answer to reveal the explanation.
Short Explanation
An unknown attachment is a locked box. A sandbox is the bomb-squad table where you open it safely and watch what it tries. DHCP leases and historian trends will not detonate the file.
Full Explanation
When a mail gateway quarantines an unknown file, the analysis tool that reveals behavior is a sandbox or malware-analysis detonation, not a host-identity or OT source. DHCP answers who had an IP; historian data answers process values; backup catalogs answer recoverability. None of those execute or instrument the sample. Choose sandbox detonation for unknown-file analysis.