A parks-site watering-hole visit is the investigative question. Which CIM fields, on which data model, should the analyst use?
Select an answer to reveal the explanation.
Short Explanation
A watering-hole visit is a web trip, not a logon and not a malware hash. Live on the Web model with url and http_user_agent. Authentication will tell you who logged in, not which parks page they fetched.
Full Explanation
A parks-site watering-hole visit is a web-browsing investigative question for the municipal SOC. The analyst should use url and http_user_agent on the Web data model to see which site was visited and with which client context from proxy or secure web gateway logs. Those fields turn normalized web telemetry into a watering-hole timeline that staff, auditors, and park operations managers can follow without reading raw vendor keys.
Using Authentication user only fails because watering-hole visits are browsing events, not logon events, even if identity later joins through Asset and Identity enrichment on the same case. Using Malware file_hash only fails because every URL is not a file hash; site visit and payload detonation are different investigative questions with different CIM models. Using Change-model object only fails by treating websites as configuration-item change records rather than visited URLs on the Web model that Enterprise Security Web dashboards expect.
Exam caveat: watering-hole and lure-URL stems map to Web fields url and http_user_agent, not Authentication, Malware, or Change as the primary model on SPLK-5001.
Operational check: query Web for the parks site URL and related http_user_agent values in the visit window, join user when present, then pivot to DNS or EDR only for follow-on resolution and execution evidence on the visiting civic hosts.