A parks-site watering-hole visit is the investigative question. Which CIM fields, on which data model, should the analyst use?
Select an answer to reveal the explanation.
Short Explanation
A watering-hole visit is a web trip, not a logon and not a malware hash. Live on the Web model with url and http_user_agent. Authentication will tell you who logged in, not which parks page they fetched.
Full Explanation
URL and HTTP user-agent live on the Web data model and are the CIM fields for proxy or web-gateway investigations such as a watering-hole visit. Authentication records logons, Malware records hashes and signatures, and Change records configuration objects. Using those models for a parks-site browse returns the wrong schema. Place URL and user-agent questions on Web-model fields.