A municipal mail-relay event is CIM-mapped with user, src_user, and dest_user populated. The question under investigation is which clerk identity sent the message through the relay. Which field should the analyst filter on?
Select an answer to reveal the explanation.
Short Explanation
Mail hops can wear three nametags. If the question is who sent through the relay, filter the sender-side tag, src_user. Recipients, URLs, and malware signatures answer different hops.
Full Explanation
CIM identity fields are hop-specific: user, src_user, and dest_user can all exist on a mail-relay event. The investigation question decides which one to filter; a sender-through-relay question uses src_user, not the recipient dest_user. url belongs on the Web model and signature on Malware; neither identifies the sending clerk on this hop. Choose the CIM identity field that matches the hop being investigated.