A transit analyst sees rare egress from a station kiosk and needs to know whether it was HTTPS or a raw high-port beacon. Which CIM fields characterize that egress?
Select an answer to reveal the explanation.
Short Explanation
HTTPS versus a weird high-port beacon is a port-and-protocol question. dest_port plus transport on the network model is that nametag. Mail users and hashes will not tell you TLS versus raw TCP.
Full Explanation
CIM network fields dest_port and transport characterize egress: 443/tcp suggests HTTPS, while a rare high destination port with unexpected transport can indicate a beacon. Identity fields on mail events, malware hashes on Authentication, and user-agent on A&I lookups do not describe that session. Use dest_port and transport to tell HTTPS from a raw high-port channel.