During one city incident, the IR lead asks who logged in as the treasurer, what that account resolved in DNS, and what binary ran on the workstation. How should the analyst pick the most useful data sources?

Useful data-source selection matches source to question. Who logged in as the treasurer maps to authentication logs; what that account resolved in DNS maps to recursive DNS logs; what binary ran on the workstation maps to EDR or endpoint process logs. During one city incident the IR lead's three questions therefore need three appropriate telemetry classes, not one universal civic log pretending to answer everything.

Collecting every civic log equally so any source can answer any question fails by inefficiency and concept—volume is not specificity and wastes investigator time. Using only the perimeter firewall fails because firewalls do not comprehensively see domain logons, DNS query names, or process creation. Using only badge-door logs fails because physical presence answers none of the three cyber questions with the fidelity required.

Exam caveat: SPLK-5001 stresses source-to-question mapping; one-log-to-rule-them-all options are almost always wrong.

Operational check: build three parallel searches—Authentication for the treasurer, DNS for resolutions from that host or user window, and EDR for process creation—then merge findings in the Enterprise Security case rather than over-collecting unrelated indexes.