The county EDR may have seen a malware family on a clerk PC. Which CIM fields on the Malware data model answer that, rather than url?
Select an answer to reveal the explanation.
Short Explanation
Did EDR see this family is a fingerprint question. On the Malware model that fingerprint is file_hash and signature, not a URL. Ports and web users live on other models.
Full Explanation
When county EDR may have seen a malware family on a clerk PC, the Malware data model fields that answer that question are file_hash and signature, not url. Hashes identify the sample seen on the civic endpoint; signature names the detection family or engine verdict that EDR or antivirus recorded. Those CIM fields let Enterprise Security Malware dashboards and hunts describe what landed without confusing delivery URLs with malware identity.
dest_port and transport on the mail gateway characterize network sessions for mail hops, not malware family identity on the clerk PC. src_user and dest_user on the Web model describe web identities and browsing actors, not EDR malware disposition. dvc on the public CMS fails because public websites are not the store of endpoint file hashes, and dvc only names a reporting device rather than a malware sample.
Exam caveat: match malware-family questions to Malware-model fields such as file_hash and signature; do not pivot to url, mail ports, or CMS devices as substitutes on SPLK-5001.
Operational check: search Malware where dest or host is the clerk PC, note file_hash and signature, enrich against Enterprise Security threat lists, quarantine if not already done, and reserve url fields for a separate web-delivery question if phishing was the entry vector.