The county EDR may have seen a malware family on a clerk PC. Which CIM fields on the Malware data model answer that, rather than url?
Select an answer to reveal the explanation.
Short Explanation
Did EDR see this family is a fingerprint question. On the Malware model that fingerprint is file_hash and signature, not a URL. Ports and web users live on other models.
Full Explanation
The Malware data model exposes file_hash and signature as the CIM fields for family and sample identity from EDR or antivirus. url belongs on the Web model and does not answer whether EDR saw a family. dest_port, transport, and mail identity fields characterize sessions or hops, not malware families. Map file-hash and signature questions to the Malware model.