County edge traffic is split across two firewall vendors that name source and destination fields differently. How should an Enterprise Security analyst write one investigation search that covers both?
Select an answer to reveal the explanation.
Short Explanation
Two brands of firehose, one nozzle: CIM. Once src and dest mean the same thing, one county search covers both vendors. Keeping a dialect per brand is how investigations fork.
Full Explanation
The Common Information Model is a shared schema that normalizes vendor-specific field names to aliases such as src and dest. That is what lets one Enterprise Security investigation search cover two firewall products. Per-vendor saved searches and raw-key-only queries reintroduce the dialect problem CIM was meant to solve. Re-indexing sourcetypes nightly is not a substitute for field mapping.