During one city incident, the IR lead asks who logged in as the treasurer, what that account resolved in DNS, and what binary ran on the workstation. How should the analyst pick the most useful data sources?
Select an answer to reveal the explanation.
Short Explanation
Most useful is not a pile of every log in the city. Auth answers who logged in, DNS answers what they resolved, and EDR answers what ran. One generic hose does not water three different gardens.
Full Explanation
The most useful data source is question-dependent. Authentication telemetry answers who logged in, recursive DNS answers what names were resolved, and endpoint detection answers what executed. Collecting everything equally, or assuming a perimeter firewall or badge reader holds all three, is a SIEM anti-pattern. Analysts should pick the source that actually contains the evidence for each question.