County edge traffic is split across two firewall vendors that name source and destination fields differently. How should an Enterprise Security analyst write one investigation search that covers both?
Select an answer to reveal the explanation.
Short Explanation
Two brands of firehose, one nozzle: CIM. Once src and dest mean the same thing, one county search covers both vendors. Keeping a dialect per brand is how investigations fork.
Full Explanation
When county edge traffic splits across two firewall vendors with different field names, the Enterprise Security analyst should write one investigation search using CIM src and dest so both vendors normalize to the same schema. Technical add-ons map vendor-specific keys into CIM aliases; accelerated data models and shared content then work across brands without duplicated logic for every municipal investigation.
Keeping a separate saved search per vendor field name and never joining them fails by operational cost and inconsistent analyst experience. Searching raw vendor keys only and ignoring CIM aliases abandons the normalization Enterprise Security content expects. Rebuilding each vendor's sourcetype nightly as a new index instead of mapping fields confuses indexing strategy with field normalization and still does not create a unified schema.
Exam caveat: multi-vendor environments require CIM normalization; do not multiply searches or indexes as a substitute for field mapping.
Operational check: verify both firewall technical add-ons tag Network_Traffic and populate src and dest, run one tstats or CIM search across both sourcetypes, and retire vendor-specific duplicate saved searches.